diff --git a/README.md b/README.md
index d014525..b889670 100644
--- a/README.md
+++ b/README.md
@@ -19,7 +19,7 @@ To run a bandit scan include a step like this:
         level: low
         confidence: high
         # exit with 0, even with results found
-        # exit_zero: true # optional, default is DEFAULT
+        # exit_zero: true # optional, default is DEFAULT (exit with results-based value)
 ```
 
 ## Inputs
diff --git a/action.yml b/action.yml
index 62d5141..42c2a3a 100644
--- a/action.yml
+++ b/action.yml
@@ -107,12 +107,20 @@ runs:
             INI_PATH="--ini $INPUT_INI_PATH"
         fi
 
+        CONFIG_PATH_ARG=""
         if [ "$INPUT_CONFIG_PATH" == "DEFAULT" ]; then
+            # Clear both
             CONFIG_PATH=""
+            CONFIG_PATH_ARG=""
+            unset CONFIG_PATH 2>dev/null || true  # also try to unset
         else
-            CONFIG_PATH="-c $INPUT_CONFIG_PATH"
+            if [ -n "$INPUT_CONFIG_PATH" ] ; then
+              # Set both (but let bandit validate its own arguments)
+              CONFIG_PATH="$INPUT_CONFIG_PATH" # quote paths on assignment
+              CONFIG_PATH_ARG="-c"
+            fi
         fi
-        bandit -f sarif -o results.sarif -r $INPUT_PATH $LEVEL $CONFIDENCE $EXCLUDED_PATHS $EXIT_ZERO $SKIPS $INI_PATH $CONFIG_PATH
+        bandit -f sarif -o results.sarif -r $INPUT_PATH $LEVEL $CONFIDENCE $EXCLUDED_PATHS $EXIT_ZERO $SKIPS $INI_PATH $CONFIG_PATH_ARG ${CONFIG_PATH:-}
       env:
         INPUT_PATH: ${{ inputs.path }}
         INPUT_LEVEL: ${{ inputs.level }}