diff --git a/.github/workflows/opencode-review-dispatch.yml b/.github/workflows/opencode-review-dispatch.yml
index 98e8d0a5b..d79d9f60b 100644
--- a/.github/workflows/opencode-review-dispatch.yml
+++ b/.github/workflows/opencode-review-dispatch.yml
@@ -1096,7 +1096,10 @@ jobs:
               echo "::error::Validated head does not contain ${relative_lock}."
               return 1
             }
-            worktree_blob="$(trusted_git hash-object --no-filters -- "$relative_lock")" || {
+            worktree_blob="$(
+              trusted_git hash-object --no-filters -- \
+                "$COVERAGE_SOURCE_WORKDIR/$relative_lock"
+            )" || {
               echo "::error::Could not hash current pnpm lock ${relative_lock}."
               return 1
             }
diff --git a/scripts/ci/test_strix_quick_gate.sh b/scripts/ci/test_strix_quick_gate.sh
index 5d1c89202..6dae8aa92 100755
--- a/scripts/ci/test_strix_quick_gate.sh
+++ b/scripts/ci/test_strix_quick_gate.sh
@@ -912,7 +912,8 @@ assert_opencode_review_uses_codegraph_and_gpt5_fallback() {
 	assert_file_contains "$workflow_file" "--offline" "coverage dependency installation refuses pnpm registry access"
 	assert_file_contains "$workflow_file" "--ignore-scripts" "coverage dependency installation suppresses pnpm lifecycle hooks"
 	assert_file_contains "$workflow_file" "trusted_pnpm_lock_matches_base()" "coverage validates the exact base and current lock before trusting it"
-	assert_file_contains "$workflow_file" 'trusted_git hash-object --no-filters -- "$relative_lock"' "coverage verifies the sandbox lock still matches the validated commit"
+	assert_file_contains "$workflow_file" '"$COVERAGE_SOURCE_WORKDIR/$relative_lock"' "coverage hashes nested pnpm locks from the validated worktree root"
+	assert_file_not_contains "$workflow_file" 'hash-object --no-filters -- "$relative_lock"' "coverage does not double-prefix nested package lock paths from the package working directory"
 	assert_file_contains "$workflow_file" "--trust-lockfile" "coverage suppresses registry attestation lookups only for an exact trusted-base lock"
 	assert_file_contains "$workflow_file" "prepare_writable_pnpm_store()" "coverage prepares a sandbox-writable clone of the trusted pnpm store"
 	assert_file_contains "$workflow_file" 'destination="$(mktemp -d /tmp/opencode-pnpm-store.XXXXXX)"' "coverage creates the writable pnpm store at an unpredictable root-owned path"
diff --git a/tests/test_opencode_agent_contract.py b/tests/test_opencode_agent_contract.py
index 2b9647a1a..3d1ca5618 100644
--- a/tests/test_opencode_agent_contract.py
+++ b/tests/test_opencode_agent_contract.py
@@ -380,9 +380,11 @@ def test_opencode_target_coverage_materializes_only_after_authorized_dispatch():
         in measure_step
     )
     assert (
-        'worktree_blob="$(trusted_git hash-object --no-filters -- "$relative_lock")"'
+        'trusted_git hash-object --no-filters -- \\\n'
+        '                "$COVERAGE_SOURCE_WORKDIR/$relative_lock"'
         in measure_step
     )
+    assert 'hash-object --no-filters -- "$relative_lock"' not in measure_step
     assert "refusing --trust-lockfile for PR-controlled dependency resolution" in measure_step
     assert "prepare_writable_pnpm_store()" in measure_step
     assert (