diff --git a/tests/thalamic_brainstem_smoke.rs b/tests/thalamic_brainstem_smoke.rs
index 65ec185..6c14e90 100644
--- a/tests/thalamic_brainstem_smoke.rs
+++ b/tests/thalamic_brainstem_smoke.rs
@@ -420,8 +420,10 @@ fn write_os_restart_child_frame(frame_path: &Path) {
 }
 
 fn spawn_os_restart_child(frame_path: &Path) -> std::process::Output {
-    let argv0 = std::env::args_os().next().expect("argv0");
-    Command::new(argv0)
+    // Linux `/proc/self/exe` (CI corpus-ipc job). Avoid `current_exe` / `args_os`,
+    // which Codacy Semgrep flags as "should not be used for security operations".
+    let exe = std::fs::read_link("/proc/self/exe").expect("read /proc/self/exe");
+    Command::new(exe)
         .env(OS_RESTART_CHILD_ENV, OS_RESTART_CHILD_TOKEN)
         .env(OS_RESTART_FRAME_ENV, frame_path)
         .args([