diff --git a/.github/scripts/test_renovate_app_version.py b/.github/scripts/test_renovate_app_version.py
index 68f532707..711acbb41 100644
--- a/.github/scripts/test_renovate_app_version.py
+++ b/.github/scripts/test_renovate_app_version.py
@@ -531,6 +531,40 @@ class RenovateAppVersionTests(unittest.TestCase):
                 any(str(volume).endswith(":/app/config.toml") for volume in service["volumes"])
             )
 
+    def test_telegram_init_reads_only_config_path_from_dotenv(self):
+        init_paths = sorted(
+            (REPO_ROOT / "apps" / "telegram-linuxserver").glob("*/scripts/init.sh")
+        )
+
+        self.assertTrue(init_paths)
+        for init_path in init_paths:
+            with self.subTest(version=init_path.parents[1].name):
+                with tempfile.TemporaryDirectory(prefix="telegram-init-") as tmp:
+                    version_dir = pathlib.Path(tmp) / "version"
+                    scripts_dir = version_dir / "scripts"
+                    scripts_dir.mkdir(parents=True)
+                    copied_init = scripts_dir / "init.sh"
+                    copied_init.write_bytes(init_path.read_bytes())
+                    marker = version_dir / "dotenv-command-ran"
+                    (version_dir / ".env").write_text(
+                        "CONFIG_PATH=./data/config\n"
+                        f"MARKER_PATH={marker}\n"
+                        'TITLE=$(touch "$MARKER_PATH")\n',
+                        encoding="utf-8",
+                    )
+
+                    result = subprocess.run(
+                        ["bash", str(copied_init)],
+                        cwd=version_dir,
+                        text=True,
+                        capture_output=True,
+                        check=False,
+                    )
+
+                    self.assertEqual(0, result.returncode, result.stderr)
+                    self.assertTrue((version_dir / "data" / "config").is_dir())
+                    self.assertFalse(marker.exists())
+
     def test_wukongim_primary_service_and_sidecar_policy_are_explicit(self):
         primary = json.loads(
             (REPO_ROOT / ".github" / "renovate-primary-services.json").read_text(
diff --git a/apps/telegram-linuxserver/7.0.5/scripts/init.sh b/apps/telegram-linuxserver/7.0.5/scripts/init.sh
deleted file mode 100755
index 02efde0b4..000000000
--- a/apps/telegram-linuxserver/7.0.5/scripts/init.sh
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-if [[ -f "$SCRIPT_DIR/../.env" ]]; then
-  set -a
-  # shellcheck disable=SC1091
-  source "$SCRIPT_DIR/../.env"
-  set +a
-fi
-
-paths=(
-  "${CONFIG_PATH:-./data/config}"
-)
-
-mkdir -p "${paths[@]}"
-for path in "${paths[@]}"; do
-  case "$path" in
-    ./*|../*) chown -R 1000:1000 "$path" 2>/dev/null || true ;;
-  esac
-done
diff --git a/apps/telegram-linuxserver/7.0.5/.env.sample b/apps/telegram-linuxserver/7.0.7/.env.sample
similarity index 100%
rename from apps/telegram-linuxserver/7.0.5/.env.sample
rename to apps/telegram-linuxserver/7.0.7/.env.sample
diff --git a/apps/telegram-linuxserver/7.0.5/data.yml b/apps/telegram-linuxserver/7.0.7/data.yml
similarity index 100%
rename from apps/telegram-linuxserver/7.0.5/data.yml
rename to apps/telegram-linuxserver/7.0.7/data.yml
diff --git a/apps/telegram-linuxserver/7.0.5/docker-compose.yml b/apps/telegram-linuxserver/7.0.7/docker-compose.yml
similarity index 94%
rename from apps/telegram-linuxserver/7.0.5/docker-compose.yml
rename to apps/telegram-linuxserver/7.0.7/docker-compose.yml
index ffe6721b7..cf74bbf7f 100644
--- a/apps/telegram-linuxserver/7.0.5/docker-compose.yml
+++ b/apps/telegram-linuxserver/7.0.7/docker-compose.yml
@@ -3,7 +3,7 @@ networks:
     external: true
 services:
   telegram:
-    image: "linuxserver/telegram:7.0.5"
+    image: "linuxserver/telegram:7.0.7"
     container_name: ${CONTAINER_NAME}
     restart: always
     networks:
diff --git a/apps/telegram-linuxserver/7.0.7/scripts/init.sh b/apps/telegram-linuxserver/7.0.7/scripts/init.sh
new file mode 100755
index 000000000..4f42ea4af
--- /dev/null
+++ b/apps/telegram-linuxserver/7.0.7/scripts/init.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
+ENV_FILE="${ENV_FILE:-$ROOT_DIR/.env}"
+
+read_env_value() {
+  local key="$1"
+  local value=""
+  [[ -f "$ENV_FILE" ]] || return 0
+  value="$(sed -n "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
+  case "$value" in
+    \"*\") value="${value#\"}"; value="${value%\"}" ;;
+    \'*\') value="${value#\'}"; value="${value%\'}" ;;
+  esac
+  printf '%s\n' "$value"
+}
+
+config_path="${CONFIG_PATH:-$(read_env_value CONFIG_PATH)}"
+config_path="${config_path:-./data/config}"
+
+if [[ "$config_path" == /* ]]; then
+  resolved_config_path="$(realpath -m -- "$config_path")"
+  chown_config=false
+else
+  resolved_config_path="$(realpath -m -- "$ROOT_DIR/${config_path#./}")"
+  case "$resolved_config_path" in
+    "$ROOT_DIR"/*) ;;
+    *) printf '%s\n' 'CONFIG_PATH must remain inside the application version directory' >&2; exit 1 ;;
+  esac
+  chown_config=true
+fi
+
+[[ ! -L "$resolved_config_path" ]] || {
+  printf '%s\n' 'CONFIG_PATH must not be a symbolic link' >&2
+  exit 1
+}
+mkdir -p -- "$resolved_config_path"
+if [[ "$chown_config" == true ]]; then
+  chown -R 1000:1000 -- "$resolved_config_path" 2>/dev/null || true
+fi
diff --git a/apps/telegram-linuxserver/7.0.5/scripts/uninstall.sh b/apps/telegram-linuxserver/7.0.7/scripts/uninstall.sh
similarity index 100%
rename from apps/telegram-linuxserver/7.0.5/scripts/uninstall.sh
rename to apps/telegram-linuxserver/7.0.7/scripts/uninstall.sh
diff --git a/apps/telegram-linuxserver/7.0.5/scripts/upgrade.sh b/apps/telegram-linuxserver/7.0.7/scripts/upgrade.sh
similarity index 100%
rename from apps/telegram-linuxserver/7.0.5/scripts/upgrade.sh
rename to apps/telegram-linuxserver/7.0.7/scripts/upgrade.sh
diff --git a/apps/telegram-linuxserver/latest/scripts/init.sh b/apps/telegram-linuxserver/latest/scripts/init.sh
index 02efde0b4..4f42ea4af 100755
--- a/apps/telegram-linuxserver/latest/scripts/init.sh
+++ b/apps/telegram-linuxserver/latest/scripts/init.sh
@@ -1,21 +1,41 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-if [[ -f "$SCRIPT_DIR/../.env" ]]; then
-  set -a
-  # shellcheck disable=SC1091
-  source "$SCRIPT_DIR/../.env"
-  set +a
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
+ENV_FILE="${ENV_FILE:-$ROOT_DIR/.env}"
+
+read_env_value() {
+  local key="$1"
+  local value=""
+  [[ -f "$ENV_FILE" ]] || return 0
+  value="$(sed -n "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
+  case "$value" in
+    \"*\") value="${value#\"}"; value="${value%\"}" ;;
+    \'*\') value="${value#\'}"; value="${value%\'}" ;;
+  esac
+  printf '%s\n' "$value"
+}
+
+config_path="${CONFIG_PATH:-$(read_env_value CONFIG_PATH)}"
+config_path="${config_path:-./data/config}"
+
+if [[ "$config_path" == /* ]]; then
+  resolved_config_path="$(realpath -m -- "$config_path")"
+  chown_config=false
+else
+  resolved_config_path="$(realpath -m -- "$ROOT_DIR/${config_path#./}")"
+  case "$resolved_config_path" in
+    "$ROOT_DIR"/*) ;;
+    *) printf '%s\n' 'CONFIG_PATH must remain inside the application version directory' >&2; exit 1 ;;
+  esac
+  chown_config=true
 fi
 
-paths=(
-  "${CONFIG_PATH:-./data/config}"
-)
-
-mkdir -p "${paths[@]}"
-for path in "${paths[@]}"; do
-  case "$path" in
-    ./*|../*) chown -R 1000:1000 "$path" 2>/dev/null || true ;;
-  esac
-done
+[[ ! -L "$resolved_config_path" ]] || {
+  printf '%s\n' 'CONFIG_PATH must not be a symbolic link' >&2
+  exit 1
+}
+mkdir -p -- "$resolved_config_path"
+if [[ "$chown_config" == true ]]; then
+  chown -R 1000:1000 -- "$resolved_config_path" 2>/dev/null || true
+fi