diff --git a/server/server.go b/server/server.go
index 6096228d..12250411 100644
--- a/server/server.go
+++ b/server/server.go
@@ -6,6 +6,7 @@ import (
 	"log/slog"
 	"net"
 	"net/http"
+	"os"
 	"sync"
 	"time"
 
@@ -108,6 +109,13 @@ func (s *Server) Start(ctx context.Context) error {
 		return errors.Wrap(err, "failed to listen")
 	}
 
+	if network == "unix" {
+		if err := os.Chmod(address, 0660); err != nil {
+			_ = listener.Close()
+			return errors.Wrap(err, "failed to chmod socket")
+		}
+	}
+
 	// Start Echo server directly (no cmux needed - all traffic is HTTP).
 	s.httpServer = &http.Server{Handler: s.echoServer}
 	go func() {