diff --git a/src/Package/Fetch.zig b/src/Package/Fetch.zig
index 373ab5be784468ed1d628f137a027fd9e16c8c87..8fe1627dbcffa60a59611392615283b070b36b75 100644
--- a/src/Package/Fetch.zig
+++ b/src/Package/Fetch.zig
@@ -257,7 +257,9 @@ pub fn run(f: *Fetch) RunError!void {
                 f.hash_tok,
                 try eb.addString("path-based dependencies are not hashed"),
             );
-            if (std.mem.startsWith(u8, pkg_root.sub_path, "../")) {
+            if (std.mem.startsWith(u8, pkg_root.sub_path, "../") or
+                std.mem.eql(u8, pkg_root.sub_path, ".."))
+            {
                 return f.fail(
                     f.location_tok,
                     try eb.printString("dependency path outside project: '{}{s}'", .{
diff --git a/src/Package/Manifest.zig b/src/Package/Manifest.zig
index 7fce7c8bcb5a9a27c389a262c2d2c445cf17c052..de1870ea75a1b04308c1e960643284fd447a885c 100644
--- a/src/Package/Manifest.zig
+++ b/src/Package/Manifest.zig
@@ -318,8 +318,7 @@ const Parse = struct {
 
         for (array_init.ast.elements) |elem_node| {
             const path_string = try parseString(p, elem_node);
-            const normalized = try std.fs.path.resolve(p.arena, &.{path_string});
-            try p.paths.put(p.gpa, normalized, {});
+            try p.paths.put(p.gpa, path_string, {});
         }
     }