diff --git a/cliff.toml b/cliff.toml
index 55ec0b28d9..17ab3071b2 100644
--- a/cliff.toml
+++ b/cliff.toml
@@ -93,8 +93,8 @@ commit_parsers = [
   { message = '^chore: (release|Release)', skip = true },
   { message = '^Release', skip = true },
   { message = "^Merge commit", skip = true },
-  { body = '.*security', group = "<!-- 08 -->🛡️ Security" },
   { message = '^(chore|fix)\(deps\):', group = "<!-- 99 -->📦️ Dependency Updates", scope = "" },
+  { message = '^(chore|fix)\(security\):', group = "<!-- 08 -->🛡️ Security" },
   { message = '^feat', group = "<!-- 00 -->🚀 Features" },
   { message = '^fix', group = "<!-- 01 -->🐛 Bug Fixes" },
   { message = '^refactor', group = "<!-- 02 -->🚜 Refactor" },
diff --git a/src/file.rs b/src/file.rs
index 1a8b40749d..131cc54cf9 100644
--- a/src/file.rs
+++ b/src/file.rs
@@ -16,6 +16,7 @@ use eyre::bail;
 use filetime::{FileTime, set_file_times};
 use flate2::read::GzDecoder;
 use itertools::Itertools;
+use path_absolutize::Absolutize;
 use std::sync::LazyLock as Lazy;
 use tar::Archive;
 use walkdir::WalkDir;
@@ -719,8 +720,9 @@ pub fn untar(archive: &Path, dest: &Path, opts: &TarOptions) -> Result<()> {
             .components()
             .skip(opts.strip_components)
             .filter(|c| c.as_os_str() != ".")
-            .collect();
-        let path = dest.join(path);
+            .collect::<PathBuf>()
+            .absolutize_virtually(dest)?
+            .to_path_buf();
         create_dir_all(path.parent().unwrap()).wrap_err_with(err)?;
         trace!("extracting {}", display_path(&path));
         entry.unpack(&path).wrap_err_with(err)?;