diff --git a/packages/schema/src/plugins/plugin-utils.ts b/packages/schema/src/plugins/plugin-utils.ts
index 546166892..482f7a7bd 100644
--- a/packages/schema/src/plugins/plugin-utils.ts
+++ b/packages/schema/src/plugins/plugin-utils.ts
@@ -9,7 +9,9 @@ export const ALL_OPERATION_KINDS: PolicyOperationKind[] = ['create', 'update', '
  */
 export function getNodeModulesFolder(startPath?: string): string | undefined {
     startPath = startPath ?? process.cwd();
-    if (fs.existsSync(path.join(startPath, 'node_modules'))) {
+    if (startPath.endsWith('node_modules')) {
+        return startPath;
+    } else if (fs.existsSync(path.join(startPath, 'node_modules'))) {
         return path.join(startPath, 'node_modules');
     } else if (startPath !== '/') {
         const parent = path.join(startPath, '..');
@@ -25,7 +27,14 @@ export function getNodeModulesFolder(startPath?: string): string | undefined {
  */
 export function getDefaultOutputFolder() {
     // Find the real runtime module path, it might be a symlink in pnpm
-    const runtimeModulePath = require.resolve('@zenstackhq/runtime');
+    let runtimeModulePath = require.resolve('@zenstackhq/runtime');
+    if (runtimeModulePath) {
+        // start with the parent folder of @zenstackhq, supposed to be a node_modules folder
+        while (!runtimeModulePath.endsWith('@zenstackhq') && runtimeModulePath !== '/') {
+            runtimeModulePath = path.join(runtimeModulePath, '..');
+        }
+        runtimeModulePath = path.join(runtimeModulePath, '..');
+    }
     const modulesFolder = getNodeModulesFolder(runtimeModulePath);
     return modulesFolder ? path.join(modulesFolder, '.zenstack') : undefined;
 }