diff --git a/frontend/scripts/verify-desktop-release.mjs b/frontend/scripts/verify-desktop-release.mjs
index 6e88cc47..6243caf7 100644
--- a/frontend/scripts/verify-desktop-release.mjs
+++ b/frontend/scripts/verify-desktop-release.mjs
@@ -29,6 +29,7 @@ const walk = async (directory) => {
 
 const permissionIdentifier = (permission) =>
   typeof permission === "string" ? permission : typeof permission?.identifier === "string" ? permission.identifier : "";
+const toPosixPath = (path) => path.split("\\").join("/");
 
 const assertPathScope = (permission, expectedPrefix, description) => {
   const allow = Array.isArray(permission.allow) ? permission.allow : [];
@@ -205,7 +206,7 @@ const verifySourceSafety = async () => {
 
   for (const path of files) {
     const source = await readFile(path, "utf8");
-    const file = relative(rootDir, path);
+    const file = toPosixPath(relative(rootDir, path));
     const isRuntimeFile = file.startsWith("frontend/src/runtime/");
     assert(!/[?&](?:token|access_token)=/i.test(source), `${file}: token must not be passed through query parameters.`);
     assert(
diff --git a/frontend/scripts/verify-runtime-boundary.mjs b/frontend/scripts/verify-runtime-boundary.mjs
index 08fbc062..545338a3 100644
--- a/frontend/scripts/verify-runtime-boundary.mjs
+++ b/frontend/scripts/verify-runtime-boundary.mjs
@@ -1,5 +1,5 @@
 import { readdir, readFile } from "node:fs/promises";
-import { extname, relative, resolve } from "node:path";
+import { extname, isAbsolute, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 const frontendDir = fileURLToPath(new URL("../", import.meta.url));
@@ -7,6 +7,7 @@ const sourceDir = resolve(frontendDir, "src");
 const runtimeDir = resolve(sourceDir, "runtime");
 const sourceExtensions = new Set([".ts", ".tsx", ".vue", ".js", ".jsx"]);
 const violations = [];
+const toPosixPath = (path) => path.split("\\").join("/");
 
 const walk = async (directory) => {
   const entries = await readdir(directory, { withFileTypes: true });
@@ -21,10 +22,12 @@ const walk = async (directory) => {
 };
 
 for (const path of await walk(sourceDir)) {
-  if (!sourceExtensions.has(extname(path)) || path.startsWith(`${runtimeDir}/`)) continue;
+  const runtimeRelativePath = relative(runtimeDir, path);
+  const isRuntimeFile = Boolean(runtimeRelativePath) && !runtimeRelativePath.startsWith("..") && !isAbsolute(runtimeRelativePath);
+  if (!sourceExtensions.has(extname(path)) || isRuntimeFile) continue;
 
   const source = await readFile(path, "utf8");
-  const file = relative(frontendDir, path);
+  const file = toPosixPath(relative(frontendDir, path));
   if (source.includes("@tauri-apps/") || source.includes("__TAURI")) {
     violations.push(`${file}: direct Tauri access is only allowed inside src/runtime`);
   }