diff --git a/backend/config/migrate.go b/backend/config/migrate.go
index db5482ba..2e591591 100644
--- a/backend/config/migrate.go
+++ b/backend/config/migrate.go
@@ -985,7 +985,8 @@ func writeLegacyMigrationBackup(directory string, data []byte, now time.Time) (s
 	if err != nil || info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
 		return "", ErrManagerStorage
 	}
-	if err := os.Chmod(backupDirectory, 0700); err != nil { // #nosec G302
+	// #nosec G302 -- 迁移备份目录仅允许应用用户访问，目录权限需要保留执行位。
+	if err := os.Chmod(backupDirectory, 0700); err != nil {
 		return "", err
 	}
 	token := make([]byte, 8)
diff --git a/backend/config/ssl_storage.go b/backend/config/ssl_storage.go
index 0636c4a8..088a0d1c 100644
--- a/backend/config/ssl_storage.go
+++ b/backend/config/ssl_storage.go
@@ -693,7 +693,8 @@ func ensureManagedDirectoryAtRoot(root, directory string) error {
 		if statErr != nil || info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
 			return ErrUnsafeSSLFile
 		}
-		if err := os.Chmod(current, 0700); err != nil { // #nosec G302
+		// #nosec G302 -- 证书存储目录仅允许应用用户访问，目录权限需要保留执行位。
+		if err := os.Chmod(current, 0700); err != nil {
 			return err
 		}
 	}
diff --git a/backend/services/adminreset/transport_unix.go b/backend/services/adminreset/transport_unix.go
index 615464d4..74d4f5b0 100644
--- a/backend/services/adminreset/transport_unix.go
+++ b/backend/services/adminreset/transport_unix.go
@@ -33,7 +33,8 @@ func ListenUnix(path string, allowedUIDs []uint32) (*UnixServer, error) {
 	if err := validateControlDirectory(parent); err != nil {
 		return nil, err
 	}
-	if err := os.Chmod(parent, 0750); err != nil { // #nosec G302
+	// #nosec G302 -- 本地控制目录需要允许受控组遍历，访问仍由属主和组权限限制。
+	if err := os.Chmod(parent, 0750); err != nil {
 		return nil, fmt.Errorf("set control directory permissions: %w", err)
 	}
 	if info, err := os.Lstat(path); err == nil {
diff --git a/backend/utils/runtimepath/deployment.go b/backend/utils/runtimepath/deployment.go
index 5c377f8b..42df0bac 100644
--- a/backend/utils/runtimepath/deployment.go
+++ b/backend/utils/runtimepath/deployment.go
@@ -64,7 +64,8 @@ func SecureDirectory(root, name string) (string, error) {
 	if err := safeDirectory(directory); err != nil {
 		return "", err
 	}
-	return directory, os.Chmod(directory, 0700) // #nosec G302
+	// #nosec G302 -- 运行目录仅允许应用用户访问，目录权限需要保留执行位。
+	return directory, os.Chmod(directory, 0700)
 }
 
 func KeyDirectory(root string) string {
diff --git a/backend/utils/runtimepath/layout.go b/backend/utils/runtimepath/layout.go
index a1bd5ab1..67152f9b 100644
--- a/backend/utils/runtimepath/layout.go
+++ b/backend/utils/runtimepath/layout.go
@@ -28,7 +28,8 @@ func Directory(root string) (string, error) {
 	if err != nil || !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
 		return "", errors.New("运行数据目录无效")
 	}
-	if err := os.Chmod(directory, 0700); err != nil { // #nosec G302
+	// #nosec G302 -- 运行数据目录仅允许应用用户访问，目录权限需要保留执行位。
+	if err := os.Chmod(directory, 0700); err != nil {
 		return "", err
 	}
 	return directory, nil