diff --git a/migrations/1788163635.sh b/migrations/1788163635.sh
index 26712800..f0925b40 100644
--- a/migrations/1788163635.sh
+++ b/migrations/1788163635.sh
@@ -1,8 +1,9 @@
 echo "Remove legacy temporary passwordless sudo grants"
 
 # Migration queues are per-user; the privileged repair is once per machine.
-# By name: secure_path resolves /usr/bin on an install and the checkout under a
-# dev link, where the installed package may predate __migrate.
-if ! omarchy-sudo-passwordless __migration-complete; then
-  sudo omarchy-sudo-passwordless __migrate
+# The helper beside this migration: the package's /usr/bin copy on an install,
+# and under a dev link the checkout's, which may be newer than the package.
+helper="$OMARCHY_PATH/bin/omarchy-sudo-passwordless"
+if ! "$helper" __migration-complete; then
+  sudo "$helper" __migrate
 fi
diff --git a/test/shell.d/passwordless-grant-lifecycle-test.sh b/test/shell.d/passwordless-grant-lifecycle-test.sh
index aba77e96..ec0af64c 100644
--- a/test/shell.d/passwordless-grant-lifecycle-test.sh
+++ b/test/shell.d/passwordless-grant-lifecycle-test.sh
@@ -44,11 +44,11 @@ pass "legacy cleanup removes generated rules for any account and quarantines eve
 
 # Run the actual migration queue for separate temporary homes. Sudo only calls
 # the mapped helper and can be refused without requesting host authorization.
-# The migration names the helper rather than a path, so both of its calls reach
-# the mapped copy through PATH, as they reach a dev checkout's through the link.
-mkdir -p "$test_tmp/source/migrations"
+# The migration reaches the helper through $OMARCHY_PATH, as the package's bin
+# links and a dev checkout provide it, so the mapped copy stands in there.
+mkdir -p "$test_tmp/source/migrations" "$test_tmp/source/bin"
 cp "$ROOT/migrations/1788163635.sh" "$test_tmp/source/migrations/"
-ln -s ../omarchy-sudo-passwordless "$test_tmp/bin/omarchy-sudo-passwordless"
+ln -s "$test_tmp/omarchy-sudo-passwordless" "$test_tmp/source/bin/omarchy-sudo-passwordless"
 printf 'echo "later migration ran"\n' >"$test_tmp/source/migrations/1788163636.sh"
 run_migrations() {
   TEST_MIGRATION=1 OMARCHY_PATH="$test_tmp/source" OMARCHY_MIGRATION_STATE="$test_tmp/$1" \