diff --git a/lib/src/pubspec.dart b/lib/src/pubspec.dart
index 3bb2e0a..a67a894 100644
--- a/lib/src/pubspec.dart
+++ b/lib/src/pubspec.dart
@@ -84,6 +84,12 @@
       if (value is! String) {
         _error('"workspace" must be a list of strings', t.span);
       }
+      if (!p.isRelative(value)) {
+        _error('"workspace" members must be relative paths', t.span);
+      }
+      if (p.equals(value, '.') || !p.isWithin('.', value)) {
+        _error('"workspace" members must be subdirectories', t.span);
+      }
       result.add(value);
     }
     return result;
diff --git a/test/workspace_test.dart b/test/workspace_test.dart
index cfa4079..0ff5d4b 100644
--- a/test/workspace_test.dart
+++ b/test/workspace_test.dart
@@ -686,4 +686,61 @@
     expect(unmanagedLockFile.statSync().type, FileSystemEntityType.file);
     expect(unmanagedPackageConfig.statSync().type, FileSystemEntityType.file);
   });
+
+  test(
+      'Reports a failure if a workspace pubspec is not nested inside the parent dir',
+      () async {
+    await dir(appPath, [
+      libPubspec(
+        'myapp',
+        '1.2.3',
+        sdk: '^3.7.0',
+        extras: {
+          'workspace': ['../'],
+        },
+      ),
+    ]).create();
+    await pubGet(
+      environment: {'_PUB_TEST_SDK_VERSION': '3.7.0'},
+      error: contains('"workspace" members must be subdirectories'),
+      exitCode: DATA,
+    );
+  });
+
+  test('Reports a failure if a workspace includes "."', () async {
+    await dir(appPath, [
+      libPubspec(
+        'myapp',
+        '1.2.3',
+        sdk: '^3.7.0',
+        extras: {
+          'workspace': ['.'],
+        },
+      ),
+    ]).create();
+    await pubGet(
+      environment: {'_PUB_TEST_SDK_VERSION': '3.7.0'},
+      error: contains('"workspace" members must be subdirectories'),
+      exitCode: DATA,
+    );
+  });
+
+  test('Reports a failure if a workspace pubspec is not a relative path',
+      () async {
+    await dir(appPath, [
+      libPubspec(
+        'myapp',
+        '1.2.3',
+        sdk: '^3.7.0',
+        extras: {
+          'workspace': [p.join(sandbox, appPath, 'a')],
+        },
+      ),
+    ]).create();
+    await pubGet(
+      environment: {'_PUB_TEST_SDK_VERSION': '3.7.0'},
+      error: contains('"workspace" members must be relative paths'),
+      exitCode: DATA,
+    );
+  });
 }