diff --git a/scripts/reset_admin_password.py b/scripts/reset_admin_password.py
index 1ecca0a..4bd046d 100644
--- a/scripts/reset_admin_password.py
+++ b/scripts/reset_admin_password.py
@@ -12,19 +12,15 @@ import secrets
 import string
 
 _here = os.path.dirname(os.path.abspath(__file__))
-# Find auth_manager: host layout has api/ sibling, container has it one level up at /app
-for _api_path in [os.path.join(_here, '..', 'api'), os.path.join(_here, '..'), '/app']:
-    if os.path.isfile(os.path.join(_api_path, 'auth_manager.py')):
-        sys.path.insert(0, os.path.normpath(_api_path))
-        break
+# In container the script lives at /app/scripts/; on host at <repo>/scripts/
+_in_container = os.path.abspath(_here) == '/app/scripts'
 
-ROOT = os.path.normpath(os.path.join(_here, '..'))
-# data dir: host uses ROOT/data/api, container mounts data/api at ROOT/data
-for _data in [os.path.join(ROOT, 'data', 'api'), os.path.join(ROOT, 'data'), '/app/data']:
-    if os.path.isdir(_data):
-        _DATA_DIR = _data
-        break
+if _in_container:
+    sys.path.insert(0, '/app')
+    _DATA_DIR = '/app/data'
 else:
+    ROOT = os.path.normpath(os.path.join(_here, '..'))
+    sys.path.insert(0, os.path.join(ROOT, 'api'))
     _DATA_DIR = os.path.join(ROOT, 'data', 'api')
 
 INIT_PW_FILE = os.path.join(_DATA_DIR, '.admin_initial_password')