diff --git a/downloader.py b/downloader.py
index c7e9b7d..3c68919 100644
--- a/downloader.py
+++ b/downloader.py
@@ -203,8 +203,23 @@ def save_metadata(item: Dict, dest: Path) -> None:
 def main() -> None:
     args = parse_args()
 
-    # Resolve output base directory and override global paths
+    # Resolve output base directory and validate it is safe
     base_dir = Path(args.output).resolve()
+    # Prevent writing to system-critical paths
+    _BLOCKED_PREFIXES = {
+        str(Path(p).resolve())
+        for p in ("/etc", "/usr", "/bin", "/sbin", "/boot", "/dev", "/proc", "/sys")
+    }
+    base_str = str(base_dir)
+    if base_str == "/" or any(
+        base_str == blocked or base_str.startswith(blocked + "/")
+        for blocked in _BLOCKED_PREFIXES
+    ):
+        print(
+            f"Error: --output cannot point to system directory: {base_dir}",
+            file=sys.stderr,
+        )
+        sys.exit(1)
     global IMG_DIR, META_DIR, STATE_FILE
     IMG_DIR = base_dir / "images"
     META_DIR = base_dir / "metadata"