diff --git a/GNUmakefile b/GNUmakefile
index e427be5..4ab5f77 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -47,7 +47,7 @@ install: install-programs
 	done
 	install -D -m 644 -t ${DESTDIR}$(systemdsystemunitdir) dist/systemd/system/crypto-auditing-agent.service
 	install -D -m 644 -t ${DESTDIR}$(systemdsystemunitdir) dist/systemd/system/crypto-auditing-event-broker.service
-	install -d ${DESTDIR}/var/lib/crypto-auditing
+	install -d ${DESTDIR}/run/crypto-auditing
 	install -d ${DESTDIR}/var/log/crypto-auditing
 
 .PHONY: check
diff --git a/crypto-auditing/src/event_broker.rs b/crypto-auditing/src/event_broker.rs
index bd15208..6208885 100644
--- a/crypto-auditing/src/event_broker.rs
+++ b/crypto-auditing/src/event_broker.rs
@@ -10,4 +10,4 @@ mod client;
 pub use client::{Client, ClientHandle};
 
 /// The default path of the Unix domain socket where the event broker is running
-pub const SOCKET_PATH: &'static str = "/var/lib/crypto-auditing/audit.sock";
+pub const SOCKET_PATH: &'static str = "/run/crypto-auditing/audit.sock";
diff --git a/dist/conf/client.conf b/dist/conf/client.conf
index a43e2c6..79d516e 100644
--- a/dist/conf/client.conf
+++ b/dist/conf/client.conf
@@ -1,2 +1,2 @@
-# socket_path = "/var/lib/crypto-auditing/audit.sock"
+# socket_path = "/run/crypto-auditing/audit.sock"
 # scope = ["tls"]
diff --git a/dist/conf/event-broker.conf b/dist/conf/event-broker.conf
index affcdc1..2eeeb73 100644
--- a/dist/conf/event-broker.conf
+++ b/dist/conf/event-broker.conf
@@ -1,2 +1,2 @@
 # log_file = "/var/log/crypto-auditing/audit.cborseq"
-# socket_path = "/var/lib/crypto-auditing/audit.sock"
+# socket_path = "/run/crypto-auditing/audit.sock"
diff --git a/dist/systemd/system/crypto-auditing-event-broker.socket b/dist/systemd/system/crypto-auditing-event-broker.socket
index 0509da6..c34b309 100644
--- a/dist/systemd/system/crypto-auditing-event-broker.socket
+++ b/dist/systemd/system/crypto-auditing-event-broker.socket
@@ -2,7 +2,7 @@
 Description=Event broker socket for crypto-auditing project
 
 [Socket]
-ListenStream=/var/lib/crypto-auditing/audit.sock
+ListenStream=/run/crypto-auditing/audit.sock
 # SocketUser=crypto-auditing
 # SocketGroup=crypto-auditing
 # SocketMode=0660