diff --git a/backend/config/migrate.go b/backend/config/migrate.go
index ba5bbb8..db5482b 100644
--- a/backend/config/migrate.go
+++ b/backend/config/migrate.go
@@ -985,7 +985,7 @@ func writeLegacyMigrationBackup(directory string, data []byte, now time.Time) (s
 	if err != nil || info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
 		return "", ErrManagerStorage
 	}
-	if err := os.Chmod(backupDirectory, 0700); err != nil {
+	if err := os.Chmod(backupDirectory, 0700); err != nil { // #nosec G302
 		return "", err
 	}
 	token := make([]byte, 8)
diff --git a/backend/config/ssl_storage.go b/backend/config/ssl_storage.go
index 7528c57..0636c4a 100644
--- a/backend/config/ssl_storage.go
+++ b/backend/config/ssl_storage.go
@@ -693,7 +693,7 @@ func ensureManagedDirectoryAtRoot(root, directory string) error {
 		if statErr != nil || info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
 			return ErrUnsafeSSLFile
 		}
-		if err := os.Chmod(current, 0700); err != nil {
+		if err := os.Chmod(current, 0700); err != nil { // #nosec G302
 			return err
 		}
 	}
diff --git a/backend/services/adminreset/transport_unix.go b/backend/services/adminreset/transport_unix.go
index e1cef60..615464d 100644
--- a/backend/services/adminreset/transport_unix.go
+++ b/backend/services/adminreset/transport_unix.go
@@ -33,7 +33,7 @@ func ListenUnix(path string, allowedUIDs []uint32) (*UnixServer, error) {
 	if err := validateControlDirectory(parent); err != nil {
 		return nil, err
 	}
-	if err := os.Chmod(parent, 0750); err != nil {
+	if err := os.Chmod(parent, 0750); err != nil { // #nosec G302
 		return nil, fmt.Errorf("set control directory permissions: %w", err)
 	}
 	if info, err := os.Lstat(path); err == nil {
diff --git a/backend/utils/runtimepath/deployment.go b/backend/utils/runtimepath/deployment.go
index 7bcca35..5c377f8 100644
--- a/backend/utils/runtimepath/deployment.go
+++ b/backend/utils/runtimepath/deployment.go
@@ -64,7 +64,7 @@ func SecureDirectory(root, name string) (string, error) {
 	if err := safeDirectory(directory); err != nil {
 		return "", err
 	}
-	return directory, os.Chmod(directory, 0700)
+	return directory, os.Chmod(directory, 0700) // #nosec G302
 }
 
 func KeyDirectory(root string) string {
diff --git a/backend/utils/runtimepath/layout.go b/backend/utils/runtimepath/layout.go
index 97ed9a4..a1bd5ab 100644
--- a/backend/utils/runtimepath/layout.go
+++ b/backend/utils/runtimepath/layout.go
@@ -28,7 +28,7 @@ func Directory(root string) (string, error) {
 	if err != nil || !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
 		return "", errors.New("运行数据目录无效")
 	}
-	if err := os.Chmod(directory, 0700); err != nil {
+	if err := os.Chmod(directory, 0700); err != nil { // #nosec G302
 		return "", err
 	}
 	return directory, nil