diff --git a/install.sh b/install.sh
index 83b7c479be..7c0def8975 100755
--- a/install.sh
+++ b/install.sh
@@ -610,11 +610,12 @@ user_home() {
 }
 
 as_target_user() {
+  _target_config_home="$(target_config_home)"
   if [ "${PLATFORM:-}" = "darwin" ]; then
     if [ "$(id -u)" -eq "$TARGET_UID" ]; then
-      env HOME="$TARGET_HOME" "$@"
+      env HOME="$TARGET_HOME" XDG_CONFIG_HOME="$_target_config_home" "$@"
     elif has_cmd sudo; then
-      sudo -u "$TARGET_USER" env HOME="$TARGET_HOME" "$@"
+      sudo -u "$TARGET_USER" env HOME="$TARGET_HOME" XDG_CONFIG_HOME="$_target_config_home" "$@"
     else
       error "cannot run commands as ${TARGET_USER}; install sudo or run as ${TARGET_USER}"
     fi
@@ -623,16 +624,24 @@ as_target_user() {
 
   _bus="unix:path=${TARGET_RUNTIME_DIR}/bus"
   if [ "$(id -u)" -eq "$TARGET_UID" ]; then
-    env HOME="$TARGET_HOME" XDG_RUNTIME_DIR="$TARGET_RUNTIME_DIR" DBUS_SESSION_BUS_ADDRESS="$_bus" "$@"
+    env HOME="$TARGET_HOME" XDG_CONFIG_HOME="$_target_config_home" XDG_RUNTIME_DIR="$TARGET_RUNTIME_DIR" DBUS_SESSION_BUS_ADDRESS="$_bus" "$@"
   elif has_cmd sudo; then
-    sudo -u "$TARGET_USER" env HOME="$TARGET_HOME" XDG_RUNTIME_DIR="$TARGET_RUNTIME_DIR" DBUS_SESSION_BUS_ADDRESS="$_bus" "$@"
+    sudo -u "$TARGET_USER" env HOME="$TARGET_HOME" XDG_CONFIG_HOME="$_target_config_home" XDG_RUNTIME_DIR="$TARGET_RUNTIME_DIR" DBUS_SESSION_BUS_ADDRESS="$_bus" "$@"
   elif has_cmd runuser; then
-    runuser -u "$TARGET_USER" -- env HOME="$TARGET_HOME" XDG_RUNTIME_DIR="$TARGET_RUNTIME_DIR" DBUS_SESSION_BUS_ADDRESS="$_bus" "$@"
+    runuser -u "$TARGET_USER" -- env HOME="$TARGET_HOME" XDG_CONFIG_HOME="$_target_config_home" XDG_RUNTIME_DIR="$TARGET_RUNTIME_DIR" DBUS_SESSION_BUS_ADDRESS="$_bus" "$@"
   else
     error "cannot run user service commands as ${TARGET_USER}; install sudo or run as ${TARGET_USER}"
   fi
 }
 
+target_config_home() {
+  if [ -n "${XDG_CONFIG_HOME:-}" ]; then
+    printf '%s\n' "$XDG_CONFIG_HOME"
+  else
+    printf '%s/.config\n' "$TARGET_HOME"
+  fi
+}
+
 detect_platform() {
   case "$(uname -s)" in
     Linux)
@@ -1020,7 +1029,7 @@ wait_for_local_gateway_listener() {
   _elapsed=0
   _last_output=""
   _probe_url="$(local_gateway_endpoint)/"
-  _mtls_dir="${TARGET_HOME}/.config/openshell/gateways/openshell/mtls"
+  _mtls_dir="$(target_config_home)/openshell/gateways/openshell/mtls"
 
   info "waiting for local gateway listener to become reachable..."
   while [ "$_elapsed" -lt "$_timeout" ]; do
@@ -1089,7 +1098,7 @@ remove_local_gateway_registration_from() {
 }
 
 remove_local_gateway_registration() {
-  remove_local_gateway_registration_from "${TARGET_HOME}/.config/openshell"
+  remove_local_gateway_registration_from "$(target_config_home)"
 }
 
 remove_snap_gateway_registration() {
diff --git a/tasks/scripts/test-install-sh.sh b/tasks/scripts/test-install-sh.sh
index 581251891c..3c8ed88b98 100755
--- a/tasks/scripts/test-install-sh.sh
+++ b/tasks/scripts/test-install-sh.sh
@@ -25,6 +25,31 @@ assert_glibc_preflight_passes() {
   fi
 }
 
+assert_target_config_home() {
+  local name=$1
+  local xdg_config_home=$2
+  local expected=$3
+  local actual
+
+  actual="$(
+    TARGET_HOME="${tmpdir}/home"
+    XDG_CONFIG_HOME="$xdg_config_home"
+    if [ "$xdg_config_home" = "__UNSET__" ]; then
+      unset XDG_CONFIG_HOME
+    fi
+    target_config_home
+  )"
+  if [ "$actual" != "$expected" ]; then
+    echo "FAIL: ${name}: expected ${expected}, got ${actual}" >&2
+    exit 1
+  fi
+}
+
+assert_target_config_home "unset XDG_CONFIG_HOME" __UNSET__ "${tmpdir}/home/.config"
+assert_target_config_home "empty XDG_CONFIG_HOME" "" "${tmpdir}/home/.config"
+assert_target_config_home "set XDG_CONFIG_HOME" "${tmpdir}/custom-config" "${tmpdir}/custom-config"
+assert_target_config_home "set XDG_CONFIG_HOME with spaces" "${tmpdir}/custom config" "${tmpdir}/custom config"
+
 assert_glibc_preflight_fails() {
   local name=$1
   local expected=$2