diff --git a/app/pipeline.py b/app/pipeline.py
index fb1d6a1..d584384 100644
--- a/app/pipeline.py
+++ b/app/pipeline.py
@@ -307,10 +307,11 @@ _UNSAFE_STEM_RE = re.compile(r"[^\w.\-]+", re.UNICODE)
 
 def sanitize_stem(name: str) -> str:
     """Safe basename stem for flat files (no path separators / junk)."""
-    # Replace separators before Path.stem so "a/b" → "a_b", not "b".
+    # Replace separators before Path.stem so "a/b" -> "a_b", not "b".
     stem = (name or "").replace("/", "_").replace("\\", "_")
-    stem = Path(stem).stem
+    # Strip leading/trailing dots first; Path(".._evil").stem returns ".".
     stem = stem.strip().strip(".")
+    stem = Path(stem).stem
     stem = _UNSAFE_STEM_RE.sub("_", stem).strip("._")
     return stem or "photo"