diff --git a/README.md b/README.md
index 9fc94d4..b08eb49 100644
--- a/README.md
+++ b/README.md
@@ -123,7 +123,7 @@ Variable | Description | Example value |
 The phar is built using box, for details see
 https://github.com/box-project/box. To built the phar just run:
 
-     composer install --dev
+     composer install
      composer build
 
 ### Create a new release
diff --git a/composer.json b/composer.json
index 89f3c5f..7db5085 100644
--- a/composer.json
+++ b/composer.json
@@ -35,7 +35,7 @@
     },
     "tools": {
       "box": {
-        "url": "https://github.com/box-project/box/releases/download/4.6.1/box.phar"
+        "url": "https://github.com/box-project/box/releases/download/4.7.0/box.phar"
       }
     },
     "enable-patching": true,
diff --git a/composer.lock b/composer.lock
index 6588674..04daa96 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "a7b984493d3bc6fa2a75473319144140",
+    "content-hash": "bf599dbe4effdd6e25f0e735c8aa3e66",
     "packages": [
         {
             "name": "composer/semver",
diff --git a/src/ScriptHandler.php b/src/ScriptHandler.php
index e3cf28c..ae3fa33 100644
--- a/src/ScriptHandler.php
+++ b/src/ScriptHandler.php
@@ -27,23 +27,42 @@ public static function installPharTools(Event $event) {
       $extras = $composer->getPackage()->getExtra();
 
       if (array_key_exists('tools', $extras)) {
+        if (!$fs->exists($bin_dir)) {
+          $fs->mkdir($bin_dir);
+        }
         foreach ($extras['tools'] as $tool => $data) {
           if (empty($data['url'])) {
             throw new \LogicException("Missing tool url.");
           }
           $filename = basename($data['url']);
-          if (!$fs->exists("$bin_dir/$filename")) {
-            if (!$fs->exists($bin_dir)) {
-              $fs->mkdir($bin_dir);
-            }
+          // The URL of the currently installed phar is recorded, such that the
+          // tool is re-installed whenever the pinned URL changes. Checking for
+          // the file only is not sufficient, since a new version may well be
+          // published under the same file name.
+          $stamp_file = "$bin_dir/.$tool.url";
+          $installed_url = $fs->exists($stamp_file) ? trim(file_get_contents($stamp_file)) : NULL;
+
+          if ($installed_url !== $data['url'] || !$fs->exists("$bin_dir/$filename")) {
             $event->getIO()->write("<info>Downloading $filename...</info>");
             $content = static::download($data['url']);
-            $fs->dumpFile("$bin_dir/$filename", $content, 0755);
-
-            if (!$fs->exists("$bin_dir/$tool")) {
-              $fs->symlink("$bin_dir/$filename", "$bin_dir/$tool");
+            $fs->dumpFile("$bin_dir/$filename", $content);
+            $fs->chmod("$bin_dir/$filename", 0755);
+            // Clean up the phar of the previously pinned version.
+            if ($installed_url && basename($installed_url) !== $filename) {
+              $fs->remove("$bin_dir/" . basename($installed_url));
             }
+            $fs->dumpFile($stamp_file, $data['url']);
+          }
+
+          // The symlink must be updated unconditionally: when the pinned URL
+          // changes it still points to the previously installed version. It is
+          // kept relative, so it keeps working when the project directory is
+          // mounted at another path; e.g. inside a container.
+          $link = "$bin_dir/$tool";
+          if ($fs->exists($link) && !is_link($link)) {
+            $fs->remove($link);
           }
+          $fs->symlink($filename, $link);
         }
       }
     }