diff --git a/lib/config/config.go b/lib/config/config.go
index 7667eff6..c123a524 100644
--- a/lib/config/config.go
+++ b/lib/config/config.go
@@ -415,8 +415,9 @@ func Load(fin io.Reader, fname string) (*Config, error) {
 		},
 		Logging: (Logging{}).Default(),
 		Metrics: &Metrics{
-			Bind:    flagLookup("metrics-bind"),
-			Network: flagLookup("metrics-bind-network"),
+			Bind:       flagLookup("metrics-bind"),
+			Network:    flagLookup("metrics-bind-network"),
+			SocketMode: flagLookup("socket-mode"),
 		},
 	}
 
diff --git a/lib/config/metrics.go b/lib/config/metrics.go
index 939f240a..37585ab2 100644
--- a/lib/config/metrics.go
+++ b/lib/config/metrics.go
@@ -1,17 +1,24 @@
 package config
 
-import "errors"
+import (
+	"errors"
+	"fmt"
+	"strconv"
+)
 
 var (
-	ErrInvalidMetricsConfig  = errors.New("config: invalid metrics configuration")
-	ErrNoMetricsBind         = errors.New("config.Metrics: must define bind")
-	ErrNoMetricsNetwork      = errors.New("config.Metrics: must define network")
-	ErrInvalidMetricsNetwork = errors.New("config.Metrics: invalid metrics network")
+	ErrInvalidMetricsConfig     = errors.New("config: invalid metrics configuration")
+	ErrNoMetricsBind            = errors.New("config.Metrics: must define bind")
+	ErrNoMetricsNetwork         = errors.New("config.Metrics: must define network")
+	ErrNoMetricsSocketMode      = errors.New("config.Metrics: must define socket mode when using unix sockets")
+	ErrInvalidMetricsSocketMode = errors.New("config.Metrics: invalid unix socket mode")
+	ErrInvalidMetricsNetwork    = errors.New("config.Metrics: invalid metrics network")
 )
 
 type Metrics struct {
-	Bind    string `json:"bind" yaml:"bind"`
-	Network string `json:"network" yaml:"network"`
+	Bind       string `json:"bind" yaml:"bind"`
+	Network    string `json:"network" yaml:"network"`
+	SocketMode string `json:"socketMode" yaml:"socketMode"`
 }
 
 func (m *Metrics) Valid() error {
@@ -26,7 +33,15 @@ func (m *Metrics) Valid() error {
 	}
 
 	switch m.Network {
-	case "tcp", "tcp4", "tcp6", "unix": // https://pkg.go.dev/net#Listen
+	case "tcp", "tcp4", "tcp6": // https://pkg.go.dev/net#Listen
+	case "unix":
+		if m.SocketMode == "" {
+			errs = append(errs, ErrNoMetricsSocketMode)
+		}
+
+		if _, err := strconv.ParseUint(m.SocketMode, 8, 0); err != nil {
+			errs = append(errs, fmt.Errorf("%w: %w", ErrInvalidMetricsSocketMode, err))
+		}
 	default:
 		errs = append(errs, ErrInvalidMetricsNetwork)
 	}
diff --git a/lib/config/metrics_test.go b/lib/config/metrics_test.go
index bd1cf8af..a92277b6 100644
--- a/lib/config/metrics_test.go
+++ b/lib/config/metrics_test.go
@@ -18,6 +18,28 @@ func TestMetricsValid(t *testing.T) {
 				Network: "tcp",
 			},
 		},
+		{
+			name: "basic TCP4",
+			input: &Metrics{
+				Bind:    ":9090",
+				Network: "tcp4",
+			},
+		},
+		{
+			name: "basic TCP6",
+			input: &Metrics{
+				Bind:    ":9090",
+				Network: "tcp6",
+			},
+		},
+		{
+			name: "basic unix",
+			input: &Metrics{
+				Bind:       "/tmp/anubis-metrics.sock",
+				Network:    "unix",
+				SocketMode: "0770",
+			},
+		},
 		{
 			name:  "no bind",
 			input: &Metrics{},
@@ -28,6 +50,23 @@ func TestMetricsValid(t *testing.T) {
 			input: &Metrics{},
 			err:   ErrNoMetricsNetwork,
 		},
+		{
+			name: "no unix socket mode",
+			input: &Metrics{
+				Bind:    "/tmp/anubis-metrics.sock",
+				Network: "unix",
+			},
+			err: ErrNoMetricsSocketMode,
+		},
+		{
+			name: "invalid unix socket mode",
+			input: &Metrics{
+				Bind:       "/tmp/anubis-metrics.sock",
+				Network:    "unix",
+				SocketMode: "taco bell",
+			},
+			err: ErrInvalidMetricsSocketMode,
+		},
 		{
 			name: "invalid network",
 			input: &Metrics{