diff --git a/scripts/test-verify-workspace-install-docs.sh b/scripts/test-verify-workspace-install-docs.sh
index 8ca51731..bba734c9 100755
--- a/scripts/test-verify-workspace-install-docs.sh
+++ b/scripts/test-verify-workspace-install-docs.sh
@@ -134,6 +134,21 @@ sed '/^case "\$mode" in/,$d' "$root/scripts/verify-workspace-install-docs.sh" >"
 # shellcheck source=/dev/null
 source "$verifier_functions"
 
+prefix_tmpdir="$(TMPDIR=/tmp bash -c 'source "$1"; printf "%s" "$tmp_prefix"' _ "$verifier_functions")"
+prefix_root="$(TMPDIR=/ bash -c 'source "$1"; printf "%s" "$tmp_prefix"' _ "$verifier_functions")"
+[[ "$prefix_tmpdir" == "/tmp/" ]] || {
+  echo "normalized /tmp prefix must be slash-terminated: $prefix_tmpdir" >&2
+  exit 1
+}
+[[ "$prefix_root" == "/" ]] || {
+  echo "normalized root prefix must remain /: $prefix_root" >&2
+  exit 1
+}
+[[ "${prefix_root}thoth-probe.XXXXXX" == "/thoth-probe.XXXXXX" ]] || {
+  echo "root prefix concatenation produced an invalid path" >&2
+  exit 1
+}
+
 PYTHONDONTWRITEBYTECODE=1 python3 "$root/scripts/test_workspace_descriptor_doc_contract.py"
 
 project_topology_fixture="$negative_root/project-topology-contradiction.md"
diff --git a/scripts/verify-workspace-install-docs.sh b/scripts/verify-workspace-install-docs.sh
index 7a876303..753369c4 100755
--- a/scripts/verify-workspace-install-docs.sh
+++ b/scripts/verify-workspace-install-docs.sh
@@ -9,6 +9,7 @@ tmp_prefix="${TMPDIR:-/tmp}"
 while [[ "$tmp_prefix" != "/" && "$tmp_prefix" == */ ]]; do
   tmp_prefix="${tmp_prefix%/}"
 done
+tmp_prefix="${tmp_prefix%/}/"
 
 trim() {
   local value="$1"
@@ -638,7 +639,7 @@ PY
 
 verify_vector_helper_interfaces() {
   local output status
-  output="$(mktemp "$tmp_prefix/thoth-vector-backup-help.XXXXXX")"
+  output="$(mktemp "${tmp_prefix}thoth-vector-backup-help.XXXXXX")"
   set +e
   "$root/scripts/vector-backup.sh" >"$output" 2>&1
   status=$?
@@ -919,7 +920,7 @@ for (const block of [setupPowerShell, healthPowerShell, updatePowerShell, backup
 }
 NODE
   local update_fixture update_script fake_bin calls output status
-  update_fixture="$(mktemp -d "$tmp_prefix/thoth-source-update.XXXXXX")"
+  update_fixture="$(mktemp -d "${tmp_prefix}thoth-source-update.XXXXXX")"
   trap 'rm -rf "$update_fixture"' RETURN
   update_script="$update_fixture/update.sh"
   awk '
@@ -1068,7 +1069,7 @@ if (!warningPattern.test(shell.slice(Math.max(0, rewriteAt - 180), rewriteAt)) |
 }
 NODE
   local repair_root repair_script real_git partial_repo clean_repo partial_output repair_status
-  repair_root="$(mktemp -d "$tmp_prefix/thoth-crlf-repair.XXXXXX")"
+  repair_root="$(mktemp -d "${tmp_prefix}thoth-crlf-repair.XXXXXX")"
   trap 'rm -rf "$repair_root"' RETURN
   repair_script="$repair_root/repair.sh"
   awk '
@@ -1699,7 +1700,7 @@ NODE
 
 verify_caddy_effective_proxy_guide() {
   local adapted
-  adapted="$(mktemp "$tmp_prefix/thoth-caddy-adapted.XXXXXX")"
+  adapted="$(mktemp "${tmp_prefix}thoth-caddy-adapted.XXXXXX")"
   if ! awk '
       /^```caddyfile$/ { code=1; next }
       code && /^```$/ { exit }
@@ -1875,7 +1876,7 @@ verify_local_installation_example() {
   }
 
   local fixture source_copy operator_dir copied_example env_file auth_config_root
-  fixture="$(mktemp -d "$tmp_prefix/thoth local install.XXXXXX")"
+  fixture="$(mktemp -d "${tmp_prefix}thoth local install.XXXXXX")"
   trap 'rm -rf "$fixture"' RETURN
   [[ "$fixture" == *" "* ]] || {
     echo "local installation fixture path does not contain spaces" >&2
@@ -1967,7 +1968,7 @@ verify_server_installation_example() {
   }
 
   local fixture source_copy operator_dir copied_example env_file backup_root auth_config_root
-  fixture="$(mktemp -d "$tmp_prefix/thoth server install.XXXXXX")"
+  fixture="$(mktemp -d "${tmp_prefix}thoth server install.XXXXXX")"
   trap 'rm -rf "$fixture"' RETURN
   [[ "$fixture" == *" "* ]] || {
     echo "server installation fixture path does not contain spaces" >&2
@@ -2154,7 +2155,7 @@ write_private() {
 
 verify_compose_fixtures() {
   local fixture profile rendered auth_config_root
-  fixture="$(mktemp -d "$tmp_prefix/thoth-install-fixtures.XXXXXX")"
+  fixture="$(mktemp -d "${tmp_prefix}thoth-install-fixtures.XXXXXX")"
   trap 'rm -rf "$fixture"' RETURN
   auth_config_root="$fixture/auth-config"
   mkdir -p "$fixture/data/workspace-secrets" "$fixture/pi-state" \