diff --git a/cli/src/m2_market/apply/local.py b/cli/src/m2_market/apply/local.py
index 6bebd11..c0f366d 100644
--- a/cli/src/m2_market/apply/local.py
+++ b/cli/src/m2_market/apply/local.py
@@ -151,6 +151,11 @@ class LocalApplyAdapter:
         if not dest.is_absolute():
             dest = home / dest
         dest = Path(os.path.normpath(str(dest)))
+        # Resolve symlinked/bind-mounted ancestors so the containment check
+        # compares real paths: on m2o desktops $HOME (/home/developer) is a
+        # mount of /agent_home/home/developer, and Path.home().resolve()
+        # already followed it — an unresolved dest would false-positive here.
+        dest = dest.resolve()
 
         if dest != home and home not in dest.parents:
             raise ValueError(