diff --git a/agent/sandbox/claude/executor_test.go b/agent/sandbox/claude/executor_test.go
index 1bbfb1e5..404ce7df 100644
--- a/agent/sandbox/claude/executor_test.go
+++ b/agent/sandbox/claude/executor_test.go
@@ -377,7 +377,7 @@ func TestClaudeExecutorIPCSocketMount(t *testing.T) {
 	ctx := context.Background()
 
 	// Check if IPC socket exists in container
-	output, err := exec.Exec(ctx, []string{"ls", "-la", "/tmp/yao.sock"})
+	output, err := exec.Exec(ctx, []string{"ls", "-la", "/run/yao.sock"})
 	require.NoError(t, err, "IPC socket should exist in container")
 	assert.Contains(t, output, "yao.sock", "Should find yao.sock file")
 	t.Logf("✓ IPC socket mounted: %s", strings.TrimSpace(output))
diff --git a/sandbox/config.go b/sandbox/config.go
index e0c020b2..cb0c197d 100644
--- a/sandbox/config.go
+++ b/sandbox/config.go
@@ -19,7 +19,7 @@ type Config struct {
 
 	// Container internal paths
 	ContainerWorkDir   string `json:"container_workdir,omitempty"`    // Container working directory, default: /workspace
-	ContainerIPCSocket string `json:"container_ipc_socket,omitempty"` // Container IPC socket path, default: /tmp/yao.sock
+	ContainerIPCSocket string `json:"container_ipc_socket,omitempty"` // Container IPC socket path, default: /run/yao.sock
 	ContainerUser      string `json:"container_user,omitempty"`       // Container user, default: "" (use image default). Set to "0" for root.
 
 	// VNC port mapping (for Docker Desktop on macOS/Windows where container IPs are not directly accessible)
@@ -112,7 +112,7 @@ func (c *Config) Init(dataRoot string) {
 	if env := os.Getenv("YAO_SANDBOX_CONTAINER_IPC"); env != "" {
 		c.ContainerIPCSocket = env
 	} else if c.ContainerIPCSocket == "" {
-		c.ContainerIPCSocket = "/tmp/yao.sock"
+		c.ContainerIPCSocket = "/run/yao.sock"
 	}
 
 	// Container user (for CI environments with UID mismatch)