diff --git a/sentinelops-backend/app/services/local_git_service.py b/sentinelops-backend/app/services/local_git_service.py
index 84afb30..39d87ce 100644
--- a/sentinelops-backend/app/services/local_git_service.py
+++ b/sentinelops-backend/app/services/local_git_service.py
@@ -136,14 +136,30 @@ def _validate_repo_path_for_linking(self, repo_path: str) -> str:
             return ""
         if not self._is_within_allowed_root(normalized):
             return ""
+
+        normalized_real = os.path.realpath(normalized)
+        if normalized_real != normalized:
+            return ""
+
         # Do not allow linking via symlinked repository directories.
         if os.path.islink(normalized):
             return ""
         if not os.path.isdir(normalized):
             return ""
+
         git_dir = os.path.join(normalized, ".git")
+        git_dir_real = os.path.realpath(git_dir)
+        normalized_prefix = normalized + os.sep
+        try:
+            if not (
+                git_dir_real == normalized
+                or git_dir_real.startswith(normalized_prefix)
+            ):
+                return ""
+        except ValueError:
+            return ""
         # Require a real .git directory inside the repository path and reject symlinks.
-        if not os.path.isdir(git_dir) or os.path.islink(git_dir):
+        if not os.path.isdir(git_dir_real) or os.path.islink(git_dir_real):
             return ""
         return normalized