diff --git a/metropolis/node/core/consensus/consensus.go b/metropolis/node/core/consensus/consensus.go
index c8fb9b5..f0a2e22 100644
--- a/metropolis/node/core/consensus/consensus.go
+++ b/metropolis/node/core/consensus/consensus.go
@@ -198,7 +198,7 @@
 			return fmt.Errorf("when issuing new cluster's first certificate: %w", err)
 		}
 
-		if err := s.config.Data.PeerPKI.MkdirAll(0600); err != nil {
+		if err := s.config.Data.PeerPKI.MkdirAll(0700); err != nil {
 			return fmt.Errorf("when creating PKI directory: %w", err)
 		}
 		if err := s.config.Data.PeerPKI.CACertificate.Write(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: st.ca.CACertRaw}), 0600); err != nil {
@@ -221,7 +221,7 @@
 		}
 	}
 
-	if err := s.config.Data.MkdirAll(0600); err != nil {
+	if err := s.config.Data.MkdirAll(0700); err != nil {
 		return fmt.Errorf("failed to create data directory; %w", err)
 	}
 
diff --git a/metropolis/node/core/consensus/consensus_test.go b/metropolis/node/core/consensus/consensus_test.go
index f6526c9..5729bc1 100644
--- a/metropolis/node/core/consensus/consensus_test.go
+++ b/metropolis/node/core/consensus/consensus_test.go
@@ -42,7 +42,10 @@
 func prep(t *testing.T) *boilerplate {
 	ctx, ctxC := context.WithCancel(context.Background())
 	root := &localstorage.Root{}
-	tmp, err := ioutil.TempDir("", "metropolis-consensus-test")
+	// Force usage of /tmp as temp directory root, otherwsie TMPDIR from Bazel
+	// returns a path long enough that socket binds in the localstorage fail
+	// (as socket names are limited to 108 characters).
+	tmp, err := ioutil.TempDir("/tmp", "metropolis-consensus-test")
 	if err != nil {
 		t.Fatal(err)
 	}