diff --git a/0002-Make-systemd-use-0700-mode-on-cache-folders.patch b/0002-Make-systemd-use-0700-mode-on-cache-folders.patch
new file mode 100644
index 0000000..b1fd196
--- /dev/null
+++ b/0002-Make-systemd-use-0700-mode-on-cache-folders.patch
@@ -0,0 +1,31 @@
+From 25147fe553525762f5dc9fcddb6ec92071fdcd3d Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Wed, 7 Aug 2024 10:27:39 +0200
+Subject: [PATCH] Make systemd use 0700 mode on cache folders
+
+The provided gssproxy.service unit configures /var/lib/gssproxy/clients
+and /var/lib/gssproxy/rcache as "StateDirectory". However, systemd
+applies mode 0755 by default on such folders. "StateDirectoryMode" has
+to be set too to restrict access to root only.
+
+Signed-off-by: Julien Rische <jrische@redhat.com>
+(cherry picked from commit b954728937c09a40409279d1247679aa5d39c7c8)
+---
+ systemd/gssproxy.service.in | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/systemd/gssproxy.service.in b/systemd/gssproxy.service.in
+index 14d2185..b8f1f77 100644
+--- a/systemd/gssproxy.service.in
++++ b/systemd/gssproxy.service.in
+@@ -6,6 +6,7 @@ Before=rpc-gssd.service
+ 
+ [Service]
+ StateDirectory=gssproxy/clients gssproxy/rcache
++StateDirectoryMode=0700
+ Environment=KRB5RCACHEDIR=/var/lib/gssproxy/rcache
+ ExecStart=@sbindir@/gssproxy -D
+ # These two should be used with traditional UNIX forking daemons
+-- 
+2.45.2
+
diff --git a/gssproxy.spec b/gssproxy.spec
index 20ec02f..8f00a3d 100644
--- a/gssproxy.spec
+++ b/gssproxy.spec
@@ -17,6 +17,7 @@ Source2:        gssproxy.sock.compat.conf
 
 ### Patches ###
 Patch0001: 0001-Fix-various-issues-detected-by-static-analysis.patch
+Patch0002: 0002-Make-systemd-use-0700-mode-on-cache-folders.patch
 
 ### Dependencies ###
 Requires: krb5-libs >= 1.12.0