diff --git a/Dockerfile.kea b/Dockerfile.kea
index d22717d..ce08c50 100644
--- a/Dockerfile.kea
+++ b/Dockerfile.kea
@@ -13,7 +13,7 @@ RUN dnf -y install epel-release \
  && dnf -y install kea kea-hooks \
  && dnf clean all \
  && rm -rf /var/cache/dnf \
- && mkdir -p /run/kea
+ && mkdir -p /var/run/kea
 
 EXPOSE 67/udp 8000/tcp
 # Command is supplied by the operator (per-container entrypoint scripts).
diff --git a/internal/kea/config_test.go b/internal/kea/config_test.go
index d6c29cc..8090cb6 100644
--- a/internal/kea/config_test.go
+++ b/internal/kea/config_test.go
@@ -231,4 +231,21 @@ func TestRenderCtrlAgent(t *testing.T) {
 			t.Errorf("ctrl-agent config missing %q", m)
 		}
 	}
+	// Kea 2.6+ only accepts unix socket paths under /var/run/kea (exact string).
+	if !strings.Contains(out, `"socket-name": "/var/run/kea/`) {
+		t.Errorf("ctrl-agent socket-name must be under /var/run/kea, got: %s", out)
+	}
+}
+
+func TestControlSocketPathAllowedByKea(t *testing.T) {
+	if !strings.HasPrefix(CtrlSocketPath, "/var/run/kea/") {
+		t.Errorf("CtrlSocketPath %q must live under /var/run/kea (kea 2.6+ restriction)", CtrlSocketPath)
+	}
+	out, err := RenderDHCP4(referenceInput())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(out, `"socket-name": "/var/run/kea/`) {
+		t.Errorf("dhcp4 control-socket must be under /var/run/kea, got: %s", out)
+	}
 }
diff --git a/internal/kea/consts.go b/internal/kea/consts.go
index 29d3852..cb48b9b 100644
--- a/internal/kea/consts.go
+++ b/internal/kea/consts.go
@@ -10,8 +10,11 @@ const (
 
 	// ConfigDir is where projected config is mounted read-only.
 	ConfigDir = "/etc/kea-operator"
-	// RunDir is a shared emptyDir for the config copy and control socket.
-	RunDir = "/run/kea"
+	// RunDir is a shared emptyDir for the config copy and control socket. Kea
+	// 2.6+ restricts unix socket paths to its compiled runstatedir and rejects
+	// anything else by exact string ("supported path is '/var/run/kea'"), even
+	// though /var/run symlinks to /run, so this must be the literal /var/run/kea.
+	RunDir = "/var/run/kea"
 
 	// DHCP4ConfPath is the runtime kea-dhcp4 config.
 	DHCP4ConfPath = RunDir + "/kea-dhcp4.conf"