diff --git a/api/profile/profile.go b/api/profile/profile.go
index 9b0dc273fe04a..d9c5987480cff 100644
--- a/api/profile/profile.go
+++ b/api/profile/profile.go
@@ -318,7 +318,7 @@ func defaultProfilePath() string {
 	// a user lookup (which can be very slow on large AD environments)
 	home, err := os.UserHomeDir()
 	if err == nil && home != "" {
-		return home
+		return filepath.Join(home, profileDir)
 	}
 
 	home = os.TempDir()
diff --git a/api/profile/profile_test.go b/api/profile/profile_test.go
index 6d22e436ae655..eab120e15093c 100644
--- a/api/profile/profile_test.go
+++ b/api/profile/profile_test.go
@@ -20,6 +20,7 @@ package profile_test
 import (
 	"os"
 	"path/filepath"
+	"runtime"
 	"testing"
 
 	"github.com/gravitational/trace"
@@ -102,3 +103,16 @@ func TestAppPath(t *testing.T) {
 	expected := filepath.Join(dir, "keys", "proxy", "testuser-app", "example.com", "banana-x509.pem")
 	require.Equal(t, expected, p.AppCertPath("banana"))
 }
+
+func TestProfilePath(t *testing.T) {
+	switch runtime.GOOS {
+	case "darwin", "linux":
+	default:
+		t.Skip("this test only runs on Unix")
+	}
+	dir := t.TempDir()
+	t.Setenv("HOME", dir)
+
+	require.Equal(t, "/foo/bar", profile.FullProfilePath("/foo/bar"))
+	require.Equal(t, filepath.Join(dir, ".tsh"), profile.FullProfilePath(""))
+}