diff --git a/scripts/security/Install-PSModules.ps1 b/scripts/security/Install-PSModules.ps1
index 872d0a2d1..8dd97fa5d 100644
--- a/scripts/security/Install-PSModules.ps1
+++ b/scripts/security/Install-PSModules.ps1
@@ -97,7 +97,7 @@ function Resolve-ConfigPath {
     if ($env:PS_MODULE_CONFIG_PATH) { return $env:PS_MODULE_CONFIG_PATH }
 
     $repoRoot = git rev-parse --show-toplevel 2>$null
-    if (-not $repoRoot) { $repoRoot = Split-Path $PSScriptRoot }
+    if (-not $repoRoot) { $repoRoot = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent }
     return Join-Path $repoRoot 'scripts/security/ps-module-versions.json'
 }
 
diff --git a/scripts/tests/security/Install-PSModules.Tests.ps1 b/scripts/tests/security/Install-PSModules.Tests.ps1
index 5e9be0b2a..dee8b1632 100644
--- a/scripts/tests/security/Install-PSModules.Tests.ps1
+++ b/scripts/tests/security/Install-PSModules.Tests.ps1
@@ -56,6 +56,29 @@ Describe 'Resolve-ConfigPath' -Tag 'Unit' {
         }
     }
 
+    Context 'when git rev-parse cannot determine the repository root' {
+        BeforeEach {
+            $script:OrigEnv = $env:PS_MODULE_CONFIG_PATH
+            $env:PS_MODULE_CONFIG_PATH = $null
+            # Simulates git being unavailable, a non-clone checkout, or a linked
+            # worktree whose main .git is unreachable, forcing the path fallback.
+            Mock git { }
+        }
+        AfterEach {
+            $env:PS_MODULE_CONFIG_PATH = $script:OrigEnv
+        }
+
+        It 'Does not duplicate the scripts path segment' {
+            $result = Resolve-ConfigPath -Explicit ''
+            $result | Should -Not -Match 'scripts[\\/]scripts'
+        }
+
+        It 'Resolves to the existing manifest at the repository root' {
+            $result = Resolve-ConfigPath -Explicit ''
+            Test-Path -LiteralPath $result | Should -BeTrue
+        }
+    }
+
     Context 'when explicit param takes precedence over env var' {
         BeforeEach {
             $script:OrigEnv = $env:PS_MODULE_CONFIG_PATH