diff --git a/helpdesk-bot/README.md b/helpdesk-bot/README.md
index b0b8464..d192eff 100644
--- a/helpdesk-bot/README.md
+++ b/helpdesk-bot/README.md
@@ -148,7 +148,7 @@ vary run to run; that's exactly why we use `trial(n=20)`.
 ## 🛠️ Step 2: Apply the fix
 
 ```bash
-git apply mitigation.patch
+git apply mitigation.patch --directory=helpdesk-bot
 ```
 
 The patch makes two changes to
@@ -270,7 +270,7 @@ To revert and play with the diff:
 ```bash
 git checkout -- helpdesk_bot/agent.py
 # or, equivalently:
-git apply -R mitigation.patch
+git apply -R mitigation.patch --directory=helpdesk-bot
 ```
 
 JSON reports for every run are written to `.report/` for offline
diff --git a/helpdesk-bot/mitigation.patch b/helpdesk-bot/mitigation.patch
index 448763e..f89aafa 100644
--- a/helpdesk-bot/mitigation.patch
+++ b/helpdesk-bot/mitigation.patch
@@ -26,8 +26,8 @@ The patch deliberately does NOT change `approval_mode`. Flipping it to
 *invocation*), not poisoned tool *arguments*. See the demo README's
 "What the patch deliberately does not change" section.
 
-Apply with `git apply mitigation.patch` from inside helpdesk-bot/.
-Revert with `git apply -R` or `git checkout -- helpdesk_bot/agent.py`.
+Apply with `git apply mitigation.patch --directory=helpdesk-bot` from inside helpdesk-bot/.
+Revert with `git apply -R mitigation.patch --directory=helpdesk-bot` or `git checkout -- helpdesk_bot/agent.py`.
 ---
 diff --git a/helpdesk_bot/agent.py b/helpdesk_bot/agent.py
 index 21f1b4e..ae6d45e 100644
diff --git a/tests/helpdesk/test_patch.py b/tests/helpdesk/test_patch.py
index 5ea2fb5..df0d2f2 100644
--- a/tests/helpdesk/test_patch.py
+++ b/tests/helpdesk/test_patch.py
@@ -34,7 +34,7 @@ def test_applies_and_reverses_cleanly(self, tmp_path: Path) -> None:
             pytest.skip("git not on PATH")
 
         work = tmp_path / "demo"
-        pkg_dir = work / "helpdesk_bot"
+        pkg_dir = work / "helpdesk-bot" / "helpdesk_bot"
         pkg_dir.mkdir(parents=True)
         shutil.copy(
             HELPDESK_BOT_DIR / "helpdesk_bot" / "agent.py",
@@ -56,17 +56,17 @@ def git(*args: str) -> subprocess.CompletedProcess[str]:
         git("init", "-q", "--initial-branch=main")
         git("config", "user.email", "smoke@local")
         git("config", "user.name", "smoke")
-        git("add", "helpdesk_bot/agent.py")
+        git("add", "helpdesk-bot/helpdesk_bot/agent.py")
         git("commit", "-qm", "baseline")
 
         # Apply. Must succeed, must produce valid Python.
-        git("apply", "mitigation.patch")
+        git("apply", "mitigation.patch", "--directory=helpdesk-bot")
         ast.parse((pkg_dir / "agent.py").read_text(encoding="utf-8"))
 
         # Reverse. After reverse the file must be byte-identical to the
-        # original baseline (so `git checkout -- helpdesk_bot/agent.py`
+        # original baseline (so `git checkout -- helpdesk-bot/helpdesk_bot/agent.py`
         # in the README is equivalent to `git apply -R`).
-        git("apply", "-R", "mitigation.patch")
+        git("apply", "-R", "mitigation.patch", "--directory=helpdesk-bot")
         original_bytes = (HELPDESK_BOT_DIR / "helpdesk_bot" / "agent.py").read_bytes()
         post_reverse_bytes = (pkg_dir / "agent.py").read_bytes()
         assert post_reverse_bytes == original_bytes