diff --git a/scripts/security/tests/test_gitea_authenticated_inventory_payload_validator.py b/scripts/security/tests/test_gitea_authenticated_inventory_payload_validator.py
index fb740109..3a94a8ea 100644
--- a/scripts/security/tests/test_gitea_authenticated_inventory_payload_validator.py
+++ b/scripts/security/tests/test_gitea_authenticated_inventory_payload_validator.py
@@ -14,7 +14,13 @@ def run_validator(path: Path | None = None, *, cwd: Path | None = None) -> dict:
     command = [sys.executable, str(SCRIPT)]
     if path:
         command.extend(["--input", str(path)])
-    result = subprocess.run(command, cwd=cwd, text=True, capture_output=True, check=True)
+    result = subprocess.run(
+        command,
+        cwd=cwd or ROOT / "apps/api",
+        text=True,
+        capture_output=True,
+        check=True,
+    )
     return json.loads(result.stdout)