diff --git a/src/main/claude-accounts/keychain.test.ts b/src/main/claude-accounts/keychain.test.ts
index a5243f56b68..a2898d17d6e 100644
--- a/src/main/claude-accounts/keychain.test.ts
+++ b/src/main/claude-accounts/keychain.test.ts
@@ -3,6 +3,7 @@ import { execFile } from 'node:child_process'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   deleteActiveClaudeKeychainCredentials,
+  getActiveClaudeService,
   readActiveClaudeKeychainCredentials,
   readActiveClaudeKeychainCredentialsStrict,
   writeActiveClaudeKeychainCredentials,
@@ -121,6 +122,12 @@ describe('Claude Keychain credentials', () => {
     ])
   })
 
+  it('derives the scoped service from the exact absolute config path', () => {
+    const configDir = '/private/var/folders/orca/claude-accounts/account-a/auth'
+
+    expect(getActiveClaudeService(configDir)).toBe(serviceForConfigDir(configDir))
+  })
+
   it('writes runtime credentials to scoped and legacy services for pre-2.1 CLIs', async () => {
     const configDir = '/tmp/orca-claude-login-test'
     const scopedService = serviceForConfigDir(configDir)
diff --git a/src/main/claude-accounts/keychain.ts b/src/main/claude-accounts/keychain.ts
index 20184571291..6584efd5e42 100644
--- a/src/main/claude-accounts/keychain.ts
+++ b/src/main/claude-accounts/keychain.ts
@@ -100,7 +100,7 @@ function getKeychainUser(): string {
   return process.env.USER || process.env.USERNAME || 'user'
 }
 
-function getActiveClaudeService(configDir?: string): string {
+export function getActiveClaudeService(configDir?: string): string {
   if (!configDir) {
     return ACTIVE_CLAUDE_SERVICE
   }