diff --git a/acceptance/acceptance_test.go b/acceptance/acceptance_test.go
index 5f1181313..12fe6536f 100644
--- a/acceptance/acceptance_test.go
+++ b/acceptance/acceptance_test.go
@@ -99,7 +99,7 @@ func TestAccept(t *testing.T) {
 		testName := strings.ReplaceAll(dir, "\\", "/")
 		t.Run(testName, func(t *testing.T) {
 			t.Parallel()
-			runTest(t, dir, coverDir, repls)
+			runTest(t, dir, coverDir, repls.Clone())
 		})
 	}
 }
@@ -137,6 +137,13 @@ func runTest(t *testing.T, dir, coverDir string, repls testdiff.ReplacementsCont
 		tmpDir = t.TempDir()
 	}
 
+	repls.Set("/private"+tmpDir, "$TMPDIR")
+	repls.Set("/private"+filepath.Dir(tmpDir), "$TMPPARENT")
+	repls.Set("/private"+filepath.Dir(filepath.Dir(tmpDir)), "$TMPGPARENT")
+	repls.Set(tmpDir, "$TMPDIR")
+	repls.Set(filepath.Dir(tmpDir), "$TMPPARENT")
+	repls.Set(filepath.Dir(filepath.Dir(tmpDir)), "$TMPGPARENT")
+
 	scriptContents := readMergedScriptContents(t, dir)
 	testutil.WriteFile(t, filepath.Join(tmpDir, EntryPointScript), scriptContents)
 
diff --git a/acceptance/bundle/sync-paths-dotdot/databricks.yml b/acceptance/bundle/sync-paths-dotdot/databricks.yml
new file mode 100644
index 000000000..7215ffea2
--- /dev/null
+++ b/acceptance/bundle/sync-paths-dotdot/databricks.yml
@@ -0,0 +1,5 @@
+bundle:
+  name: test-bundle
+sync:
+  paths:
+    - ..
diff --git a/acceptance/bundle/sync-paths-dotdot/output.txt b/acceptance/bundle/sync-paths-dotdot/output.txt
new file mode 100644
index 000000000..11db3e9ee
--- /dev/null
+++ b/acceptance/bundle/sync-paths-dotdot/output.txt
@@ -0,0 +1,11 @@
+Error: path "$TMPPARENT" is not within repository root "$TMPDIR"
+
+Name: test-bundle
+Target: default
+Workspace:
+  User: $USERNAME
+  Path: /Workspace/Users/$USERNAME/.bundle/test-bundle/default
+
+Found 1 error
+
+Exit code: 1
diff --git a/acceptance/bundle/sync-paths-dotdot/script b/acceptance/bundle/sync-paths-dotdot/script
new file mode 100644
index 000000000..72555b332
--- /dev/null
+++ b/acceptance/bundle/sync-paths-dotdot/script
@@ -0,0 +1 @@
+$CLI bundle validate
diff --git a/acceptance/bundle/variables/prepend-workspace-var/databricks.yml b/acceptance/bundle/variables/prepend-workspace-var/databricks.yml
new file mode 100644
index 000000000..c843752f8
--- /dev/null
+++ b/acceptance/bundle/variables/prepend-workspace-var/databricks.yml
@@ -0,0 +1,24 @@
+workspace:
+  profile: profile_name
+  root_path: ${var.workspace_root}/path/to/root
+
+variables:
+  workspace_root:
+    description: "root directory in the Databricks workspace to store the asset bundle and associated artifacts"
+    default: /Users/${workspace.current_user.userName}
+
+targets:
+  dev:
+    default: true
+  prod:
+    variables:
+      workspace_root: /Shared
+
+resources:
+  jobs:
+    my_job:
+      tasks:
+        - existing_cluster_id: 500
+          python_wheel_task:
+            named_parameters:
+              conf-file: "${workspace.file_path}/path/to/config.yaml"
diff --git a/acceptance/bundle/variables/prepend-workspace-var/output.txt b/acceptance/bundle/variables/prepend-workspace-var/output.txt
new file mode 100644
index 000000000..575fac6d4
--- /dev/null
+++ b/acceptance/bundle/variables/prepend-workspace-var/output.txt
@@ -0,0 +1,67 @@
+/Workspace should be prepended on all paths, but it is not the case:
+{
+  "bundle": {
+    "environment": "dev",
+    "git": {
+      "bundle_root_path": ".",
+      "inferred": true
+    },
+    "target": "dev",
+    "terraform": {
+      "exec_path": "$TMPHOME"
+    }
+  },
+  "resources": {
+    "jobs": {
+      "my_job": {
+        "deployment": {
+          "kind": "BUNDLE",
+          "metadata_file_path": "/Users/$USERNAME/path/to/root/state/metadata.json"
+        },
+        "edit_mode": "UI_LOCKED",
+        "format": "MULTI_TASK",
+        "permissions": [],
+        "queue": {
+          "enabled": true
+        },
+        "tags": {},
+        "tasks": [
+          {
+            "existing_cluster_id": "500",
+            "python_wheel_task": {
+              "named_parameters": {
+                "conf-file": "/Users/$USERNAME/path/to/root/files/path/to/config.yaml"
+              }
+            },
+            "task_key": ""
+          }
+        ]
+      }
+    }
+  },
+  "sync": {
+    "paths": [
+      "."
+    ]
+  },
+  "targets": null,
+  "variables": {
+    "workspace_root": {
+      "default": "/Users/$USERNAME",
+      "description": "root directory in the Databricks workspace to store the asset bundle and associated artifacts",
+      "value": "/Users/$USERNAME"
+    }
+  },
+  "workspace": {
+    "artifact_path": "/Users/$USERNAME/path/to/root/artifacts",
+    "current_user": {
+      "short_name": "$USERNAME",
+      "userName": "$USERNAME"
+    },
+    "file_path": "/Users/$USERNAME/path/to/root/files",
+    "profile": "profile_name",
+    "resource_path": "/Users/$USERNAME/path/to/root/resources",
+    "root_path": "/Users/$USERNAME/path/to/root",
+    "state_path": "/Users/$USERNAME/path/to/root/state"
+  }
+}
\ No newline at end of file
diff --git a/acceptance/bundle/variables/prepend-workspace-var/script b/acceptance/bundle/variables/prepend-workspace-var/script
new file mode 100644
index 000000000..de6bc8a17
--- /dev/null
+++ b/acceptance/bundle/variables/prepend-workspace-var/script
@@ -0,0 +1,2 @@
+echo /Workspace should be prepended on all paths, but it is not the case: #2181
+$CLI bundle validate -o json
diff --git a/libs/testdiff/replacement.go b/libs/testdiff/replacement.go
index 1ab976109..207f425aa 100644
--- a/libs/testdiff/replacement.go
+++ b/libs/testdiff/replacement.go
@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"regexp"
+	"slices"
 	"strings"
 
 	"github.com/databricks/cli/internal/testutil"
@@ -31,6 +32,10 @@ type ReplacementsContext struct {
 	Repls []Replacement
 }
 
+func (r *ReplacementsContext) Clone() ReplacementsContext {
+	return ReplacementsContext{Repls: slices.Clone(r.Repls)}
+}
+
 func (r *ReplacementsContext) Replace(s string) string {
 	// QQQ Should probably only replace whole words
 	for _, repl := range r.Repls {