diff --git a/bread-utils/src/xdg.rs b/bread-utils/src/xdg.rs
index 30542f5..4409fd0 100644
--- a/bread-utils/src/xdg.rs
+++ b/bread-utils/src/xdg.rs
@@ -11,6 +11,11 @@
 //! - `breadpad-shared/src/classifier.rs:34-39` (`model_dir`)
 //! - `breadpad-shared/src/config.rs:214-219` and `:221-226`
 //!   (`config_path`, `style_css_path`)
+//! - `breadmon/src/profile.rs:31-35` (`profiles_dir`)
+//! - `breadarr-shared/src/config.rs:316-321`'s own `expand_home` helper,
+//!   which had the same bug in a different shape: its *own* fallback (when
+//!   `HOME` itself isn't set) returned the literal, unexpanded input string
+//!   rather than a real path.
 //!
 //! The helpers here resolve a real `$HOME` (via `dirs::home_dir()`, which
 //! itself falls back to reading `HOME` directly) before ever falling back,
@@ -18,6 +23,13 @@
 
 use std::path::PathBuf;
 
+/// A real, absolute home directory — `dirs::home_dir()`, falling back to
+/// `/root` only if that itself fails (no `HOME` env var *and* no passwd-db
+/// entry, e.g. some minimal container contexts). Never a literal `"~"`.
+pub fn home_dir() -> PathBuf {
+    home_or_root()
+}
+
 fn home_or_root() -> PathBuf {
     dirs::home_dir().unwrap_or_else(|| PathBuf::from("/root"))
 }
@@ -80,6 +92,13 @@ mod tests {
         assert!(d.is_absolute());
     }
 
+    #[test]
+    fn home_dir_is_absolute_and_never_a_literal_tilde() {
+        let d = home_dir();
+        assert!(d.is_absolute());
+        assert!(!d.components().any(|c| c.as_os_str() == "~"));
+    }
+
     #[test]
     fn data_dir_never_contains_literal_tilde() {
         // Regression guard for the exact bug this module replaces: the