diff --git a/scripts/doctor.mjs b/scripts/doctor.mjs
index 04ffd83..737bce1 100644
--- a/scripts/doctor.mjs
+++ b/scripts/doctor.mjs
@@ -178,8 +178,17 @@ export async function runDoctor(opts = {}) {
   };
 }
 
-// CLI entrypoint
-if (import.meta.url === `file://${process.argv[1]}`) {
+// CLI entrypoint — use fileURLToPath + realpath to handle symlinked install paths
+// (e.g. /tmp/ → /private/tmp/ on macOS would otherwise miss the guard).
+import { fileURLToPath } from "node:url";
+import { realpathSync } from "node:fs";
+function _isMain() {
+  if (!process.argv[1]) return false;
+  try {
+    return realpathSync(fileURLToPath(import.meta.url)) === realpathSync(process.argv[1]);
+  } catch { return false; }
+}
+if (_isMain()) {
   const wantJson = process.argv.includes("--json");
   const result = await runDoctor();
   if (wantJson) {
diff --git a/scripts/upgrade.mjs b/scripts/upgrade.mjs
index dea84bf..bc321a9 100644
--- a/scripts/upgrade.mjs
+++ b/scripts/upgrade.mjs
@@ -280,8 +280,16 @@ async function runRollback(opts) {
   return { path: "rollback", executed: true, changed: true, target: target.path, phases };
 }
 
-// CLI entrypoint
-if (import.meta.url === `file://${process.argv[1]}`) {
+// CLI entrypoint — use fileURLToPath + realpath to handle symlinked install paths.
+import { fileURLToPath } from "node:url";
+import { realpathSync } from "node:fs";
+function _isMain() {
+  if (!process.argv[1]) return false;
+  try {
+    return realpathSync(fileURLToPath(import.meta.url)) === realpathSync(process.argv[1]);
+  } catch { return false; }
+}
+if (_isMain()) {
   const args = process.argv.slice(2);
   const dryRun = args.includes("--dry-run");
   const yes = args.includes("--yes");