diff --git a/src/lib/task-origin-validate.ts b/src/lib/task-origin-validate.ts
index b3a99f6..a807210 100644
--- a/src/lib/task-origin-validate.ts
+++ b/src/lib/task-origin-validate.ts
@@ -116,8 +116,11 @@ export async function buildAndValidateSignature(options: TaskOriginVerifyOptions
 
   // Validate paths are within the allowed directory if specified
   if (allowedDir) {
-    assertWithinDir(taskFolderPath, allowedDir);
-    assertWithinDir(signatureFile, allowedDir);
+    const resolvedTaskFolderPath = await fs.realpath(taskFolderPath);
+    const resolvedSignatureFile = await fs.realpath(signatureFile);
+
+    assertWithinDir(resolvedTaskFolderPath, allowedDir);
+    assertWithinDir(resolvedSignatureFile, allowedDir);
   }
 
   // Extract the bundle containing both the signature and certificate chain
@@ -254,8 +257,11 @@ export async function verifyTaskOrigin(options: TaskOriginVerifyOptions): Promis
 
   // Validate paths are within the allowed directory if specified
   if (allowedDir) {
-    assertWithinDir(taskFolderPath, allowedDir);
-    assertWithinDir(signatureFile, allowedDir);
+    const resolvedTaskFolderPath = await fs.realpath(taskFolderPath);
+    const resolvedSignatureFile = await fs.realpath(signatureFile);
+
+    assertWithinDir(resolvedTaskFolderPath, allowedDir);
+    assertWithinDir(resolvedSignatureFile, allowedDir);
   }
 
   // Make sure that the task folder path and signature file exist