diff --git a/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/SetCommandLineTests.cs b/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/SetCommandLineTests.cs
index 4daadbf..57e1bd3 100644
--- a/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/SetCommandLineTests.cs
+++ b/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/SetCommandLineTests.cs
@@ -171,14 +171,20 @@ public sealed class SetCommandLineTests
         private readonly string _dir = Path.Combine(Path.GetTempPath(), $"zb-cli-{Guid.NewGuid():N}");
         private readonly string _key = Convert.ToBase64String(RandomNumberGenerator.GetBytes(32));
 
-        public CliRig() => Directory.CreateDirectory(_dir);
+        // The CLI's host takes its working directory as the content root, and the store must sit
+        // OUTSIDE the content root. The store used to live under the working directory; the old
+        // lexical path rule missed that on macOS only because the temp path is spelled /var/... while
+        // the working directory reports /private/var/... (Secrets-005 resolves the symlink).
+        private string WorkDir => Path.Combine(_dir, "work");
+
+        public CliRig() => Directory.CreateDirectory(Path.Combine(_dir, "work"));
 
         public async Task<CliResult> RunAsync(string[] args, string? stdin = null)
         {
             string dll = Path.Combine(AppContext.BaseDirectory, "ZB.MOM.WW.Secrets.Cli.dll");
             var psi = new ProcessStartInfo(Environment.GetEnvironmentVariable("DOTNET_HOST_PATH") ?? "dotnet")
             {
-                WorkingDirectory = _dir,
+                WorkingDirectory = WorkDir,
                 RedirectStandardInput = true,
                 RedirectStandardOutput = true,
                 RedirectStandardError = true,