diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index c7b18159e..52588a887 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -2270,7 +2270,7 @@ dependencies = [
  "mutants",
  "netlink-packet-core",
  "netlink-packet-route",
- "nix 0.29.0",
+ "nix 0.30.1",
  "resolv-conf",
  "ring",
  "rtnetlink",
@@ -2318,7 +2318,7 @@ dependencies = [
  "jemallocator",
  "libc",
  "moka",
- "nix 0.29.0",
+ "nix 0.30.1",
  "num_cpus",
  "opentelemetry",
  "opentelemetry-stdout",
@@ -2365,7 +2365,7 @@ dependencies = [
  "ip-packet",
  "keyring",
  "native-dialog",
- "nix 0.29.0",
+ "nix 0.30.1",
  "output_vt100",
  "phoenix-channel",
  "png",
@@ -2426,7 +2426,7 @@ dependencies = [
  "ip-packet",
  "known-folders",
  "libc",
- "nix 0.29.0",
+ "nix 0.30.1",
  "opentelemetry",
  "opentelemetry-stdout",
  "opentelemetry_sdk",
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index 641fe3230..b0f99e5a7 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -108,7 +108,7 @@ native-dialog = "0.7.0"
 netlink-packet-core = "0.7"
 netlink-packet-route = "0.24"
 network-types = "0.0.8"
-nix = "0.29.0"
+nix = "0.30.1"
 nu-ansi-term = "0.50"
 num_cpus = "1.17.0"
 once_cell = "1.21.3"
diff --git a/rust/headless-client/src/linux.rs b/rust/headless-client/src/linux.rs
index f1645cfb6..3dd139062 100644
--- a/rust/headless-client/src/linux.rs
+++ b/rust/headless-client/src/linux.rs
@@ -3,6 +3,7 @@
 use super::TOKEN_ENV_KEY;
 use anyhow::{Result, bail};
 use firezone_bin_shared::BUNDLE_ID;
+use nix::fcntl::AT_FDCWD;
 use std::path::{Path, PathBuf};
 
 // The Client currently must run as root to control DNS
@@ -15,7 +16,7 @@ pub(crate) fn default_token_path() -> PathBuf {
 }
 
 pub(crate) fn check_token_permissions(path: &Path) -> Result<()> {
-    let Ok(stat) = nix::sys::stat::fstatat(None, path, nix::fcntl::AtFlags::empty()) else {
+    let Ok(stat) = nix::sys::stat::fstatat(AT_FDCWD, path, nix::fcntl::AtFlags::empty()) else {
         // File doesn't exist or can't be read
         tracing::info!(
             ?path,