diff --git a/ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Cli/appsettings.json b/ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Cli/appsettings.json
index 8f8dcf5..e66026a 100644
--- a/ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Cli/appsettings.json
+++ b/ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Cli/appsettings.json
@@ -1,6 +1,5 @@
 {
   "Secrets": {
-    "SqlitePath": "secrets.db",
     "MasterKey": {
       "Source": "Environment",
       "EnvVarName": "ZB_SECRETS_MASTER_KEY"
diff --git a/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/ShippedCliSettingsTests.cs b/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/ShippedCliSettingsTests.cs
new file mode 100644
index 0000000..35fa6b6
--- /dev/null
+++ b/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/ShippedCliSettingsTests.cs
@@ -0,0 +1,47 @@
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Options;
+using ZB.MOM.WW.Secrets.DependencyInjection;
+
+namespace ZB.MOM.WW.Secrets.Tests.Cli;
+
+/// <summary>
+/// scadaproj#49: the <c>appsettings.json</c> the CLI ships must pass the store-path validator. It
+/// used to set <c>"SqlitePath": "secrets.db"</c>, which the validator rejects as relative, so the
+/// headless CLI could not start from its own directory unless an environment variable overrode it.
+/// </summary>
+public sealed class ShippedCliSettingsTests
+{
+    private static string RepoFile(params string[] relative)
+    {
+        for (DirectoryInfo? dir = new(AppContext.BaseDirectory); dir is not null; dir = dir.Parent)
+        {
+            if (File.Exists(Path.Combine(dir.FullName, "ZB.MOM.WW.Secrets.slnx")))
+            {
+                return Path.Combine(new[] { dir.FullName }.Concat(relative).ToArray());
+            }
+        }
+
+        throw new InvalidOperationException("Could not locate ZB.MOM.WW.Secrets.slnx above the test output.");
+    }
+
+    private static SecretsOptions Validate(IConfiguration config)
+    {
+        var services = new ServiceCollection();
+        services.AddZbSecrets(config, "Secrets");
+        using ServiceProvider sp = services.BuildServiceProvider();
+        return sp.GetRequiredService<IOptions<SecretsOptions>>().Value;
+    }
+
+    [Fact]
+    public void The_cli_appsettings_passes_store_path_validation()
+    {
+        IConfiguration config = new ConfigurationBuilder()
+            .AddJsonFile(RepoFile("src", "ZB.MOM.WW.Secrets.Cli", "appsettings.json"), optional: false)
+            .Build();
+
+        SecretsOptions options = Validate(config);
+
+        Assert.True(Path.IsPathFullyQualified(options.SqlitePath));
+    }
+}