diff --git a/src/main.js b/src/main.js
index b15ba0c..38892fb 100644
--- a/src/main.js
+++ b/src/main.js
@@ -12,9 +12,13 @@ function readJSON(filename) {
     return parsedJSON;
 }
 
-function cleanupOutput(resultsJSONFile, outputFormats) {
+async function cleanupOutput(resultsJSONFile, outputFormats) {
     if (!outputFormats.toLowerCase().includes('json') || outputFormats === '') {
-        io.rmRF(resultsJSONFile);
+        // the entrypoint copied the report into the action dir, KICS wrote the original into the workspace
+        const copies = new Set([filepath.resolve(resultsJSONFile), filepath.resolve(process.env.GITHUB_WORKSPACE || '', resultsJSONFile)]);
+        for (const copy of copies) {
+            await io.rmRF(copy);
+        }
     }
 }
 
@@ -88,7 +92,7 @@ async function main() {
         }
 
         setWorkflowStatus(exitCode);
-        cleanupOutput(outputPath.resultsJSONFile, outputFormats);
+        await cleanupOutput(outputPath.resultsJSONFile, outputFormats);
     } catch (e) {
         console.error(e);
     }
diff --git a/test/e2e/entrypoint.test.js b/test/e2e/entrypoint.test.js
index 02fb2a3..a58e547 100644
--- a/test/e2e/entrypoint.test.js
+++ b/test/e2e/entrypoint.test.js
@@ -216,11 +216,21 @@ test('whole action: entrypoint, KICS, JavaScript stage and GitHub', async (t) =>
         assert.doesNotMatch(run.stdout, /^::(warning|error)/m)
     })
 
-    await t.test('the workspace is left without a results.json nobody asked for', knownBug('output_formats: sarif still leaves results.json in the workspace; main.js only removes the copy inside /app'), async (t) => {
+    await t.test('the workspace is left without a results.json nobody asked for', async (t) => {
         const run = await runEntrypoint(t, { runMain: true, results: kicsResults(), inputs: { output_formats: 'sarif' } })
         assert.equal(fs.existsSync(path.join(run.workspace, 'results.json')), false)
     })
 
+    await t.test('the workspace is left without a results.json nobody asked for in output_path', async (t) => {
+        const run = await runEntrypoint(t, { runMain: true, results: kicsResults(), inputs: { output_formats: 'sarif', output_path: 'reports' } })
+        assert.equal(fs.existsSync(path.join(run.workspace, 'reports', 'results.json')), false)
+    })
+
+    await t.test('the workspace keeps the results.json when json was requested', async (t) => {
+        const run = await runEntrypoint(t, { runMain: true, results: kicsResults(), inputs: { output_formats: 'json' } })
+        assert.equal(fs.existsSync(path.join(run.workspace, 'results.json')), true)
+    })
+
     await t.test('reports from a config file with a custom output-name are still picked up', knownBug('main.js only reads results.json, so a config with output-name makes the scan fail with ENOENT (#96, #106)'), async (t) => {
         const run = await runEntrypoint(t, {
             runMain: true,