diff --git a/cmd/keyctl/main.go b/cmd/keyctl/main.go
index f449823..276bcd3 100644
--- a/cmd/keyctl/main.go
+++ b/cmd/keyctl/main.go
@@ -12,6 +12,7 @@ import (
 	"syscall"
 	"time"
 
+	"git.giftfish.de/ston1th/godrop/v2"
 	"git.giftfish.de/ston1th/keyctl/pkg/api"
 	"git.giftfish.de/ston1th/keyctl/pkg/cli"
 	"git.giftfish.de/ston1th/keyctl/pkg/db"
@@ -71,10 +72,16 @@ func server() {
 
 	log = klogr.New().WithName("main")
 	log.Info("starting keyctl", "version", version)
+	err := godrop.PledgePromises("stdio rpath wpath cpath inet fattr flock unix unveil")
+	if err != nil {
+		klog.Fatalf("init failed: %s", err)
+	}
+
 	dbstore, err := db.New(klogr.New().WithName("db"), path)
 	if err != nil {
 		klog.Fatalf("init failed: %s", err)
 	}
+
 	srv, err := api.NewServer(klogr.New().WithName("srv"), listen, filepath.Join(path, socket), dbstore)
 	if err != nil {
 		klog.Fatalf("init failed: %s", err)
diff --git a/pkg/api/client/client.go b/pkg/api/client/client.go
index 6e6878a..0ca7cfe 100644
--- a/pkg/api/client/client.go
+++ b/pkg/api/client/client.go
@@ -22,6 +22,7 @@ import (
 
 type Client struct {
 	endpoint    string
+	unix        string
 	httpClient  *http.Client
 	dialer      *net.Dialer
 	dialerFunc  func(ctx context.Context, network, addr string) (net.Conn, error)
@@ -50,6 +51,7 @@ func WithEndpoint(endpoint string) ClientOption {
 				return client.dialer.DialContext(ctx, "unix", u.Path)
 			}
 			client.endpoint = "http://unix"
+			client.unix = u.Path
 			return
 		}
 		client.dialerFunc = client.dialer.DialContext
@@ -189,6 +191,10 @@ func NewClient(options ...ClientOption) *Client {
 	return client
 }
 
+func (c *Client) IsUnix() (socket string, ok bool) {
+	return c.unix, c.unix != ""
+}
+
 func (c *Client) NewRequest(ctx context.Context, method, path string, body io.Reader) (*http.Request, error) {
 	url := c.endpoint + path
 	req, err := http.NewRequest(method, url, body)
diff --git a/pkg/cli/cli.go b/pkg/cli/cli.go
index f52a408..39db19b 100644
--- a/pkg/cli/cli.go
+++ b/pkg/cli/cli.go
@@ -14,6 +14,7 @@ import (
 	"strings"
 	"text/tabwriter"
 
+	"git.giftfish.de/ston1th/godrop/v2"
 	apiclient "git.giftfish.de/ston1th/keyctl/pkg/api/client"
 	clientv1 "git.giftfish.de/ston1th/keyctl/pkg/api/v1/client"
 	"git.giftfish.de/ston1th/keyctl/pkg/api/v1/schema"
@@ -29,6 +30,17 @@ func exit(err error) {
 
 func Run(arg string) {
 	ctx := context.Background()
+	pledge := "stdio unveil"
+	switch arg {
+	case "new", "ls", "req", "approve", "reject", "del":
+		pledge += " unix"
+	case "get":
+		pledge += " unix inet dns"
+	}
+	err := godrop.PledgePromises(pledge)
+	if err != nil {
+		exit(err)
+	}
 	switch arg {
 	case "new":
 		name, existing, encoding, t, size, err := newKeyFlags()
@@ -148,6 +160,12 @@ func client() (c *clientv1.Client) {
 		exit(err)
 	}
 	apic := apiclient.NewClient(opts...)
+	if socket, ok := apic.IsUnix(); ok {
+		err = unveil(socket)
+		if err != nil {
+			exit(err)
+		}
+	}
 	c, err = clientv1.NewClient(apic)
 	if err != nil {
 		exit(err)
@@ -155,6 +173,14 @@ func client() (c *clientv1.Client) {
 	return
 }
 
+func unveil(socket string) error {
+	err := godrop.Unveil(socket, "rwc")
+	if err != nil {
+		return err
+	}
+	return godrop.UnveilBlock()
+}
+
 func jsonOutput(v any) {
 	b, err := json.Marshal(v)
 	if err != nil {