diff --git a/src/runner/ssh-server.sh b/src/runner/ssh-server.sh
index c0c58e7..a9c0210 100644
--- a/src/runner/ssh-server.sh
+++ b/src/runner/ssh-server.sh
@@ -97,6 +97,8 @@ else
 fi
 
 mkdir -p /var/run/sshd
+chown root:root /var/run/sshd
+chmod 0755 /var/run/sshd
 mkdir -p /etc/ssh/sshd_config.d
 '
 
diff --git a/tests/runtime.test.ts b/tests/runtime.test.ts
index c62de38..e35b19d 100644
--- a/tests/runtime.test.ts
+++ b/tests/runtime.test.ts
@@ -667,6 +667,16 @@ describe("buildStartRunnerScript", () => {
   });
 });
 
+describe("bundled runner script", () => {
+  test("normalizes the sshd runtime directory permissions regardless of umask", async () => {
+    const script = await readFile(new URL("../src/runner/ssh-server.sh", import.meta.url), "utf8");
+
+    expect(script).toContain("mkdir -p /var/run/sshd");
+    expect(script).toContain("chown root:root /var/run/sshd");
+    expect(script).toContain("chmod 0755 /var/run/sshd");
+  });
+});
+
 describe("isDockerRootlessSecurityOptions", () => {
   test("detects a rootless docker engine", () => {
     expect(isDockerRootlessSecurityOptions(["name=seccomp,profile=builtin", "name=rootless"])).toBe(true);