diff --git a/index.js b/index.js
index 6a9d85e..243f814 100644
--- a/index.js
+++ b/index.js
@@ -80,8 +80,13 @@ webPush.setVapidDetails(
 async function saveFile(structureId, req, uploadedFile, asset=false) {
   const name = uploadedFile.name;
   const [mime_type, mime_subtype] = uploadedFile.mimetype.split("/");
-  const uploadPath = path.join(__dirname, "public", structureId);
-  const storedPath = path.join(structureId, uploadedFile.name);
+  // structureId may arrive as a number (route.structure_id is an INTEGER) when
+  // called from a sandboxed handler via require('files').saveFile — the workshop
+  // /files route passes a string param, which masked this. path.join demands
+  // strings, so coerce.
+  const sid = String(structureId);
+  const uploadPath = path.join(__dirname, "public", sid);
+  const storedPath = path.join(sid, uploadedFile.name);
 
   fs.mkdirSync(uploadPath, { recursive: true });