diff --git a/TODO.md b/TODO.md
index 25930baa..4720814c 100644
--- a/TODO.md
+++ b/TODO.md
@@ -52,7 +52,7 @@ the owner's OS user and can never be granted. Indirection there really is accide
       `'Unverified'` and `signin.ts` refuses anything else with a bare UNAUTHORIZED, which is the trap
       the hand-INSERT route fell into. The owner sets the password and reads it out; `passwordChangedAt`
       stays null. Directories come from the shared `provisionUserDirs`/`USER_DIRS` in `data-path.ts`,
-      which `scripts/setup/provision-user-dirs.ts` now imports rather than restating.
+      which `scripts/provision-user-dirs.ts` now imports rather than restating.
 
 - [ ] **Still no invite flow, and no password reset for a member.** The owner types the password and
       tells the person, which means the owner knows it and the member cannot change it back if they
diff --git a/scripts/setup/cleanup-desktop.sh b/scripts/cleanup-desktop.sh
similarity index 96%
rename from scripts/setup/cleanup-desktop.sh
rename to scripts/cleanup-desktop.sh
index 54063436..27583687 100755
--- a/scripts/setup/cleanup-desktop.sh
+++ b/scripts/cleanup-desktop.sh
@@ -26,7 +26,7 @@ set -euo pipefail
 # their profile in it. Opt in rather than surprise someone.
 #
 # Usage:
-#   bash scripts/setup/cleanup-desktop.sh [--purge-brave]
+#   bash scripts/cleanup-desktop.sh [--purge-brave]
 #
 # Reboot afterwards: the GDM and GRUB changes are both boot-time.
 
@@ -131,9 +131,9 @@ fi
 
 # --- Step 7: .env ---
 echo "[7/7] Cleaning .env..."
-# ../.. — this lives in scripts/setup/. A wrong level here is quiet in the other direction: the sed
-# below simply finds no file, reports "No .env" and leaves the real VNC_PASSWORD in place.
-ENV_FILE="$(cd "$(dirname "$0")/../.." && pwd)/.env"
+# A wrong level here is quiet: the sed below simply finds no file, reports "No .env" and leaves the real
+# VNC_PASSWORD in place. Keep this in step with wherever this script lives.
+ENV_FILE="$(cd "$(dirname "$0")/.." && pwd)/.env"
 if [ -f "$ENV_FILE" ]; then
   sed -i '/^VNC_PASSWORD=/d; /^VNC_PORT=/d' "$ENV_FILE"
   echo "  Removed VNC entries."
diff --git a/scripts/setup/provision-user-dirs.ts b/scripts/provision-user-dirs.ts
similarity index 88%
rename from scripts/setup/provision-user-dirs.ts
rename to scripts/provision-user-dirs.ts
index b0bb3677..0b576fa9 100644
--- a/scripts/setup/provision-user-dirs.ts
+++ b/scripts/provision-user-dirs.ts
@@ -1,7 +1,7 @@
 // Create the per-user root under DATA_PATH for the given accounts.
 //
-//   bun scripts/setup/provision-user-dirs.ts a@b.com c@d.com
-//   DRY_RUN=1 bun scripts/setup/provision-user-dirs.ts a@b.com
+//   bun scripts/provision-user-dirs.ts a@b.com c@d.com
+//   DRY_RUN=1 bun scripts/provision-user-dirs.ts a@b.com
 //
 // Takes emails as arguments rather than reading the user table: the directory layout does not depend
 // on the database, and keeping the DB out means this runs with nothing else up. At invite time the
@@ -19,13 +19,13 @@ import { join } from 'node:path';
 // The list and DATA_PATH itself come from the platform rather than being restated here. The owner's
 // create-account handler provisions the same skeleton, and a script that drifted from it would produce
 // accounts that differ by how they were made. Importing data-path.ts pulls in no database and no server.
-import { DATA_PATH, USER_DIRS } from '../../src/servers/data-path';
+import { DATA_PATH, USER_DIRS } from '../src/servers/data-path';
 
 const DRY_RUN = process.env.DRY_RUN === '1';
 const emails = process.argv.slice(2).filter(Boolean);
 
 if (!emails.length) {
-  console.error('Usage: bun scripts/setup/provision-user-dirs.ts <email> [email...]');
+  console.error('Usage: bun scripts/provision-user-dirs.ts <email> [email...]');
   process.exit(2);
 }
 
diff --git a/src/servers/data-path.ts b/src/servers/data-path.ts
index 69e65ab7..b74c2768 100644
--- a/src/servers/data-path.ts
+++ b/src/servers/data-path.ts
@@ -50,7 +50,7 @@ export const getOwnerHomeDir = (email: string): string => process.env.HOME_DIR ?
 // non-owner's sessions would run.
 //
 // Single-sourced here rather than in the script that used to own the list, because there are now two
-// callers — `scripts/setup/provision-user-dirs.ts` and the owner's create-account handler — and a skeleton
+// callers — `scripts/provision-user-dirs.ts` and the owner's create-account handler — and a skeleton
 // that differs depending on how the account was made is a bug nobody would think to look for.
 export const USER_DIRS = ['home', 'attachments', 'cache', 'dashboards', 'email_accounts', 'logs', 'sidecar'] as const;