diff --git a/native/src/core/daemon.cpp b/native/src/core/daemon.cpp
index 33594245e..78731a20b 100644
--- a/native/src/core/daemon.cpp
+++ b/native/src/core/daemon.cpp
@@ -179,9 +179,6 @@ static void handle_request_sync(int client, int code) {
     case MainRequest::CHECK_VERSION_CODE:
         write_int(client, MAGISK_VER_CODE);
         break;
-    case MainRequest::GET_PATH:
-        write_string(client, MAGISKTMP.data());
-        break;
     case MainRequest::START_DAEMON:
         rust::get_magiskd().setup_logfile();
         break;
@@ -240,7 +237,6 @@ static void handle_request(pollfd *pfd) {
     case MainRequest::BOOT_COMPLETE:
     case MainRequest::ZYGOTE_RESTART:
     case MainRequest::SQLITE_CMD:
-    case MainRequest::GET_PATH:
     case MainRequest::DENYLIST:
     case MainRequest::STOP_DAEMON:
         if (!is_root) {
@@ -415,15 +411,26 @@ static void daemon_entry() {
     poll_loop();
 }
 
+string find_magisk_tmp() {
+    if (access("/debug_ramdisk/" INTLROOT, F_OK) == 0) {
+        return "/debug_ramdisk";
+    }
+    if (access("/sbin/" INTLROOT, F_OK) == 0) {
+        return "/sbin";
+    }
+    // Fallback to lookup from mountinfo for manual mount, e.g. avd
+    for (const auto &mount: parse_mount_info("self")) {
+        if (mount.source == "magisk" && mount.root == "/") {
+            return mount.target;
+        }
+    }
+    return "";
+}
+
 int connect_daemon(int req, bool create) {
     int fd = xsocket(AF_LOCAL, SOCK_STREAM | SOCK_CLOEXEC, 0);
     sockaddr_un addr = {.sun_family = AF_LOCAL};
-    string tmp;
-    for (const auto &info: parse_mount_info("self")) {
-        if (info.source == "magisk" && info.root == "/") {
-            tmp = info.target;
-        }
-    }
+    string tmp = find_magisk_tmp();
     strcpy(addr.sun_path, (tmp + "/" MAIN_SOCKET).data());
     if (connect(fd, (sockaddr *) &addr, sizeof(addr))) {
         if (!create || getuid() != AID_ROOT) {
diff --git a/native/src/core/magisk.cpp b/native/src/core/magisk.cpp
index 39abd174d..01e568214 100644
--- a/native/src/core/magisk.cpp
+++ b/native/src/core/magisk.cpp
@@ -129,10 +129,12 @@ int magisk_main(int argc, char *argv[]) {
         write_int(fd, do_reboot);
         return read_int(fd);
     } else if (argv[1] == "--path"sv) {
-        int fd = connect_daemon(MainRequest::GET_PATH);
-        string path = read_string(fd);
-        printf("%s\n", path.data());
-        return 0;
+        string path = find_magisk_tmp();
+        if (!path.empty())  {
+            printf("%s\n", path.data());
+            return 0;
+        }
+        return 1;
     } else if (argc >= 3 && argv[1] == "--install-module"sv) {
         install_module(argv[2]);
     } else if (argv[1] == "--preinit-device"sv) {
diff --git a/native/src/include/daemon.hpp b/native/src/include/daemon.hpp
index b68f1c2d0..d2292472e 100644
--- a/native/src/include/daemon.hpp
+++ b/native/src/include/daemon.hpp
@@ -25,7 +25,6 @@ enum : int {
     START_DAEMON,
     CHECK_VERSION,
     CHECK_VERSION_CODE,
-    GET_PATH,
     STOP_DAEMON,
 
     _SYNC_BARRIER_,
@@ -72,6 +71,7 @@ extern int app_process_32;
 extern int app_process_64;
 extern std::vector<module_info> *module_list;
 
+std::string find_magisk_tmp();
 int connect_daemon(int req, bool create = false);
 
 // Poll control
diff --git a/native/src/zygisk/deny/cli.cpp b/native/src/zygisk/deny/cli.cpp
index 7cf163751..0e9e7434f 100644
--- a/native/src/zygisk/deny/cli.cpp
+++ b/native/src/zygisk/deny/cli.cpp
@@ -84,9 +84,6 @@ int denylist_cli(int argc, char **argv) {
     else if (argv[1] == "exec"sv && argc > 2) {
         xunshare(CLONE_NEWNS);
         xmount(nullptr, "/", nullptr, MS_PRIVATE | MS_REC, nullptr);
-        int fd = connect_daemon(MainRequest::GET_PATH);
-        MAGISKTMP = read_string(fd);
-        close(fd);
         revert_unmount();
         execvp(argv[2], argv + 2);
         exit(1);