diff --git a/core/phpunit.xml.dist b/core/phpunit.xml.dist
index 2620fe9..c4ed22d 100644
--- a/core/phpunit.xml.dist
+++ b/core/phpunit.xml.dist
@@ -20,33 +20,47 @@
     <testsuite name="unit">
       <directory>./tests/Drupal/Tests</directory>
       <directory>./modules/*/tests/src/Unit</directory>
-      <directory>../modules/*/tests/src/Unit</directory>
+      <!-- Allow for discovery of tests in sub-directories in the top-level
+           modules/ directory. -->
+      <directory>../modules</directory>
       <directory>../profiles/*/tests/src/Unit</directory>
+      <!-- Do not find tests in sub-directory modules under sites/. This is a
+           security measure. Move modules to modules/ for testing. -->
       <directory>../sites/*/modules/*/tests/src/Unit</directory>
       <!-- Exclude Composer's vendor directory so we don't run tests there. -->
-      <exclude>./vendor</exclude>
+      <exclude>../vendor</exclude>
+      <!-- Exclude vendor directories which may be present in modules/. -->
+      <exclude>../modules/*/vendor</exclude>
       <!-- Exclude Drush tests. -->
       <exclude>./drush/tests</exclude>
     </testsuite>
     <testsuite name="kernel">
       <directory>./tests/Drupal/KernelTests</directory>
       <directory>./modules/*/tests/src/Kernel</directory>
-      <directory>../modules/*/tests/src/Kernel</directory>
+      <!-- Allow for discovery of tests in sub-directories in the top-level
+           modules/ directory. -->
+      <directory>../modules</directory>
       <directory>../profiles/*/tests/src/Kernel</directory>
       <directory>../sites/*/modules/*/tests/src/Kernel</directory>
       <!-- Exclude Composer's vendor directory so we don't run tests there. -->
-      <exclude>./vendor</exclude>
+      <exclude>../vendor</exclude>
+      <!-- Exclude vendor directories which may be present in modules/. -->
+      <exclude>../modules/*/vendor</exclude>
       <!-- Exclude Drush tests. -->
       <exclude>./drush/tests</exclude>
     </testsuite>
     <testsuite name="functional">
       <directory>./tests/Drupal/FunctionalTests</directory>
       <directory>./modules/*/tests/src/Functional</directory>
-      <directory>../modules/*/tests/src/Functional</directory>
+      <!-- Allow for discovery of tests in sub-directories in the top-level
+           modules/ directory. -->
+      <directory>../modules</directory>
       <directory>../profiles/*/tests/src/Functional</directory>
       <directory>../sites/*/modules/*/tests/src/Functional</directory>
       <!-- Exclude Composer's vendor directory so we don't run tests there. -->
-      <exclude>./vendor</exclude>
+      <exclude>../vendor</exclude>
+      <!-- Exclude vendor directories which may be present in modules/. -->
+      <exclude>../modules/*/vendor</exclude>
       <!-- Exclude Drush tests. -->
       <exclude>./drush/tests</exclude>
     </testsuite>