diff --git a/plugins/codex-security/scripts/generate_in_scope_files.py b/plugins/codex-security/scripts/generate_in_scope_files.py
index 8e61e5009b..8144abaeb7 100644
--- a/plugins/codex-security/scripts/generate_in_scope_files.py
+++ b/plugins/codex-security/scripts/generate_in_scope_files.py
@@ -270,7 +270,8 @@ def write_inventory(output: Path, rows: list[bytes]) -> int:
         with tempfile.NamedTemporaryFile(
             mode="wb",
             dir=output.parent,
-            prefix=f".{output.name}.",
+            # Including the output name can exceed the filesystem's 255-byte name limit.
+            prefix=".",
             suffix=".tmp",
             delete=False,
         ) as handle:
diff --git a/plugins/codex-security/tests/test_generate_in_scope_files.py b/plugins/codex-security/tests/test_generate_in_scope_files.py
index 27d1eb50ee..62e009d8c5 100644
--- a/plugins/codex-security/tests/test_generate_in_scope_files.py
+++ b/plugins/codex-security/tests/test_generate_in_scope_files.py
@@ -115,7 +115,7 @@ def test_inventory_matches_the_existing_standard_command(tmp_path: Path, scope:
 
     assert result.returncode == 0, result.stderr
     assert output.read_bytes() == standard_inventory(repository, scope)
-    assert list(output.parent.glob(f".{output.name}.*.tmp")) == []
+    assert list(output.parent.glob(".*.tmp")) == []
     if scope == ".":
         rows = set(output.read_text(encoding="utf-8").splitlines())
         assert {
@@ -131,6 +131,19 @@ def test_inventory_matches_the_existing_standard_command(tmp_path: Path, scope:
         assert {"./ignored/secret.py", "./app/ignored.skip"}.isdisjoint(rows)
 
 
+@pytest.mark.parametrize("name", [f"{'a' * 251}.txt", f"{'文' * 83}.txt"])
+def test_inventory_replaces_outputs_with_long_filenames(tmp_path: Path, name: str) -> None:
+    repository = make_repository(tmp_path)
+    output = tmp_path / name
+    output.write_text("previous.py\n", encoding="utf-8")
+
+    result = run_inventory(repository, ".", output)
+
+    assert result.returncode == 0, result.stderr
+    assert output.read_bytes() == standard_inventory(repository, ".")
+    assert list(output.parent.glob(".*.tmp")) == []
+
+
 def test_absolute_scope_still_produces_repository_relative_paths(tmp_path: Path) -> None:
     repository = make_repository(tmp_path)
     output = tmp_path / "in_scope_files.txt"
@@ -278,7 +291,7 @@ def test_inventory_rejects_line_breaks_before_serializing_paths(
     assert "path that cannot fit in the file inventory" in result.stderr
     assert result.stdout == ""
     assert output.read_bytes() == previous
-    assert list(output.parent.glob(f".{output.name}.*.tmp")) == []
+    assert list(output.parent.glob(".*.tmp")) == []
 
 
 def test_diff_inventory_includes_power_shell_files(