diff --git a/dist/varde.service b/dist/varde.service
index 4e3aa36..8db5d04 100644
--- a/dist/varde.service
+++ b/dist/varde.service
@@ -15,11 +15,13 @@ Restart=on-failure
 # Hardening
 DynamicUser=yes
 StateDirectory=varde
-RuntimeDirectory=varde
-# The socket unit's file lives in this directory: removing it on every
-# service stop (the default) left varde.socket listening on an unlinked
-# path after any restart - "active" with nothing to connect to.
-RuntimeDirectoryPreserve=yes
+# No RuntimeDirectory= here: varde.socket creates /run/varde for its
+# socket file, and the service only uses the activation socket. With
+# RuntimeDirectory= on the service, stopping it removed the socket file
+# from under the socket unit (0.1.6 and earlier), and preserving it
+# (0.1.7/0.1.8) made systemd privatise the directory under DynamicUser -
+# /run/varde -> /run/private/varde, 0700 - so no unprivileged client
+# could connect at all.
 NoNewPrivileges=yes
 ProtectSystem=strict
 ProtectHome=yes
diff --git a/dist/varde.socket b/dist/varde.socket
index fdafb64..5a77cd3 100644
--- a/dist/varde.socket
+++ b/dist/varde.socket
@@ -5,6 +5,9 @@ Description=varde API socket
 [Socket]
 ListenStream=/run/varde/varde.sock
 SocketMode=0666
+# The directory is this unit's, world-readable, so clients of any user
+# reach the socket (see varde.service for why the service must not own it).
+DirectoryMode=0755
 
 [Install]
 WantedBy=sockets.target