diff --git a/install.sh b/install.sh
index 41fd22ac..17643b02 100755
--- a/install.sh
+++ b/install.sh
@@ -118,7 +118,7 @@ nvm_node_version() {
 
 nvm_download() {
   if nvm_has_executable "curl"; then
-    curl --fail --compressed -q "$@"
+    command curl --fail --compressed -q "$@"
   elif nvm_has_executable "wget"; then
     # Emulate curl with wget
     ARGS=$(nvm_echo "$@" | command sed -e 's/--progress-bar /--progress=bar /' \
diff --git a/nvm.sh b/nvm.sh
index d291f119..4c30e215 100755
--- a/nvm.sh
+++ b/nvm.sh
@@ -113,7 +113,7 @@ nvm_get_latest() {
     if nvm_curl_use_compression; then
       CURL_COMPRESSED_FLAG="--compressed"
     fi
-    NVM_LATEST_URL="$(curl ${CURL_COMPRESSED_FLAG:-} -q -w "%{url_effective}\\n" -L -s -S https://latest.nvm.sh -o /dev/null)"
+    NVM_LATEST_URL="$(command curl ${CURL_COMPRESSED_FLAG:-} -q -w "%{url_effective}\\n" -L -s -S https://latest.nvm.sh -o /dev/null)"
   elif nvm_has_executable "wget"; then
     NVM_LATEST_URL="$(command wget -q https://latest.nvm.sh --server-response -O /dev/null 2>&1 | command awk '/^  Location: /{DEST=$2} END{ print DEST }')"
   else
diff --git a/test/slow/nvm_get_latest/nvm_get_latest b/test/slow/nvm_get_latest/nvm_get_latest
index 41830b72..0a12b21c 100755
--- a/test/slow/nvm_get_latest/nvm_get_latest
+++ b/test/slow/nvm_get_latest/nvm_get_latest
@@ -6,6 +6,7 @@ WORK="$PWD/nvm_get_latest-work.$$"
 TEST_BIN="$WORK/bin"
 
 cleanup() {
+  unset -f curl wget
   rm -rf "$WORK"
   export PATH="$OLDPATH"
 }
@@ -96,6 +97,17 @@ chmod +x "$TEST_BIN/wget"
 
 export PATH="$TEST_BIN:$OLDPATH"
 
+# shadowing shell functions, like aliases baked into a user's shell, must be
+# bypassed in favor of the executables on PATH (https://github.com/nvm-sh/nvm/issues/2923)
+curl() {
+  echo >&2 'the shadowing curl function was called'
+  return 1
+}
+wget() {
+  echo >&2 'the shadowing wget function was called'
+  return 1
+}
+
 try nvm_get_latest
 [ "_$CAPTURED_STDOUT" = "_$EXPECTED_VERSION" ] \
   || die "success path did not return version '$EXPECTED_VERSION', got '$CAPTURED_STDOUT'"