diff --git a/src/create-project.sh b/src/create-project.sh
index 1744752..9a03090 100644
--- a/src/create-project.sh
+++ b/src/create-project.sh
@@ -14,8 +14,8 @@
 #   create-project.sh --help | --version
 #
 # Options
-#   --config FILE   service addresses (default: config.env next to the script)
-#   --env FILE      credentials (default: .env next to the script)
+#   --config FILE   service addresses (default: config.env in the project root)
+#   --env FILE      credentials (default: .env in the project root)
 #   -h, --help      show this help
 #   --version       show the version
 #
@@ -73,9 +73,13 @@ esac
 SCRIPT_DIR="$(cd "$script_path_dir" && pwd)"
 readonly SCRIPT_DIR
 unset script_path_dir
+# The script lives in src/; the configuration files live one level up, in
+# the project root, next to config.env.example and .env.example.
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+readonly PROJECT_ROOT
 
-CONFIG_FILE="$SCRIPT_DIR/config.env"
-ENV_FILE="$SCRIPT_DIR/.env"
+CONFIG_FILE="$PROJECT_ROOT/config.env"
+ENV_FILE="$PROJECT_ROOT/.env"
 TMP_DIR=""
 HAS_JQ=0
 HTTP_STATUS=0
diff --git a/tests/lib.sh b/tests/lib.sh
index 66c3907..4fdbd0a 100644
--- a/tests/lib.sh
+++ b/tests/lib.sh
@@ -11,7 +11,7 @@
 # shellcheck disable=SC2016,SC2034  # stub and snippet text is literal on purpose; OUT, ERR and STATUS are read by the test files
 REPO_ROOT="$(cd "${BASH_SOURCE[0]%/*}/.." && pwd)"
 readonly REPO_ROOT
-readonly SCRIPT="$REPO_ROOT/create-project.sh"
+readonly SCRIPT="$REPO_ROOT/src/create-project.sh"
 
 # Distinctive fake credentials; the tests search all output for them.
 readonly FAKE_GITEA_TOKEN="giteaFAKEtoken1234567890"
diff --git a/tests/test-security.sh b/tests/test-security.sh
index a26cb16..cd4b69c 100644
--- a/tests/test-security.sh
+++ b/tests/test-security.sh
@@ -174,3 +174,27 @@ test_termination_removes_temp_files() {
   exec 7>&-
   assert_eq "temp directory removed after SIGTERM" "" "$(find "$WORK/tmp" -mindepth 1)"
 }
+
+test_script_lives_in_src() {
+  assert_file_exists "script in src/" "$REPO_ROOT/src/create-project.sh"
+  assert_file_missing "no copy in the project root" "$REPO_ROOT/create-project.sh"
+}
+
+test_default_files_are_in_the_project_root() {
+  # A project copy: script in src/, config.env and .env one level up.
+  write_fixtures
+  mkdir -p "$WORK/project/src"
+  cp "$SCRIPT" "$WORK/project/src/create-project.sh"
+  cp "$WORK/config.env" "$WORK/project/config.env"
+  cp "$WORK/.env" "$WORK/project/.env"
+  STATUS=0
+  PATH="$WORK/bin:$PATH" TMPDIR="$WORK/tmp" "$BASH" "$WORK/project/src/create-project.sh" \
+    <<<"$ANSWERS_GITHUB" >"$WORK/out.txt" 2>"$WORK/err.txt" || STATUS=$?
+  assert_status "run with the default files" 0 "$STATUS"
+  assert_contains "found config.env in the project root" "$(cat "$WORK/out.txt")" "https://git.example.test/TirSystem/my-app"
+  # Run from another directory: the defaults follow the script, not the cwd.
+  STATUS=0
+  (cd "$WORK" && PATH="$WORK/bin:$PATH" TMPDIR="$WORK/tmp" "$BASH" "$WORK/project/src/create-project.sh" \
+    <<<"$ANSWERS_GITEA_ONLY" >"$WORK/out.txt" 2>"$WORK/err.txt") || STATUS=$?
+  assert_status "run from another directory" 0 "$STATUS"
+}