diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9bd720f923e..23bdf4f1bdc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Release Notes for Craft CMS 5
 
+## Unreleased
+
+- Fixed a bug where an empty `@storage/runtime` directory could be created within the webroot. ([#18986](https://github.com/craftcms/cms/pull/18986))
+
 ## 5.10.4 - 2026-05-27
 
 - Updated Twig to 3.27. ([#18980](https://github.com/craftcms/cms/pull/18980))
diff --git a/bootstrap/bootstrap.php b/bootstrap/bootstrap.php
index cacedeae491..2cea0470cf2 100644
--- a/bootstrap/bootstrap.php
+++ b/bootstrap/bootstrap.php
@@ -297,8 +297,8 @@
     craft_modify_app_config($config, $appType);
 }
 
-// Create the storage/runtime/ folder if it doesn't already exist
-$runtimePath = $config['runtimePath'] ?? $storagePath . DIRECTORY_SEPARATOR . 'runtime';
+// Create the runtime folder if it doesn't already exist
+$runtimePath = Craft::getAlias($config['runtimePath']);
 $createFolder($runtimePath);
 $ensureFolderIsReadable($runtimePath, true);