diff --git a/services/server/config/config_test.go b/services/server/config/config_test.go
index e81800501..39d3a6616 100644
--- a/services/server/config/config_test.go
+++ b/services/server/config/config_test.go
@@ -86,7 +86,7 @@ func TestResolveImports(t *testing.T) {
 	tempDir := t.TempDir()
 
 	for _, filename := range []string{"config_1.toml", "config_2.toml", "test.toml"} {
-		err := os.WriteFile(filepath.Join(tempDir, filename), []byte(""), 0600)
+		err := os.WriteFile(filepath.Join(tempDir, filename), []byte(""), 0o600)
 		assert.NoError(t, err)
 	}
 
@@ -118,7 +118,7 @@ root = "/var/lib/containerd"
 	tempDir := t.TempDir()
 
 	path := filepath.Join(tempDir, "config.toml")
-	err := os.WriteFile(path, []byte(data), 0600)
+	err := os.WriteFile(path, []byte(data), 0o600)
 	assert.NoError(t, err)
 
 	var out Config
@@ -147,10 +147,10 @@ disabled_plugins = ["io.containerd.v1.xyz"]
 
 	tempDir := t.TempDir()
 
-	err := os.WriteFile(filepath.Join(tempDir, "data1.toml"), []byte(data1), 0600)
+	err := os.WriteFile(filepath.Join(tempDir, "data1.toml"), []byte(data1), 0o600)
 	assert.NoError(t, err)
 
-	err = os.WriteFile(filepath.Join(tempDir, "data2.toml"), []byte(data2), 0600)
+	err = os.WriteFile(filepath.Join(tempDir, "data2.toml"), []byte(data2), 0o600)
 	assert.NoError(t, err)
 
 	var out Config
@@ -175,10 +175,10 @@ imports = ["data1.toml", "data2.toml"]
 `
 	tempDir := t.TempDir()
 
-	err := os.WriteFile(filepath.Join(tempDir, "data1.toml"), []byte(data1), 0600)
+	err := os.WriteFile(filepath.Join(tempDir, "data1.toml"), []byte(data1), 0o600)
 	assert.NoError(t, err)
 
-	err = os.WriteFile(filepath.Join(tempDir, "data2.toml"), []byte(data2), 0600)
+	err = os.WriteFile(filepath.Join(tempDir, "data2.toml"), []byte(data2), 0o600)
 	assert.NoError(t, err)
 
 	var out Config
@@ -207,7 +207,7 @@ version = 2
 	tempDir := t.TempDir()
 
 	path := filepath.Join(tempDir, "config.toml")
-	err := os.WriteFile(path, []byte(data), 0600)
+	err := os.WriteFile(path, []byte(data), 0o600)
 	assert.NoError(t, err)
 
 	var out Config
@@ -230,7 +230,7 @@ func TestDecodePluginInV1Config(t *testing.T) {
 `
 
 	path := filepath.Join(t.TempDir(), "config.toml")
-	err := os.WriteFile(path, []byte(data), 0600)
+	err := os.WriteFile(path, []byte(data), 0o600)
 	assert.NoError(t, err)
 
 	var out Config
diff --git a/services/server/server.go b/services/server/server.go
index bf775aa63..f013f3800 100644
--- a/services/server/server.go
+++ b/services/server/server.go
@@ -81,16 +81,16 @@ func CreateTopLevelDirectories(config *srvconfig.Config) error {
 		return errors.New("root and state must be different paths")
 	}
 
-	if err := sys.MkdirAllWithACL(config.Root, 0711); err != nil {
+	if err := sys.MkdirAllWithACL(config.Root, 0o711); err != nil {
 		return err
 	}
 
-	if err := sys.MkdirAllWithACL(config.State, 0711); err != nil {
+	if err := sys.MkdirAllWithACL(config.State, 0o711); err != nil {
 		return err
 	}
 
 	if config.TempDir != "" {
-		if err := sys.MkdirAllWithACL(config.TempDir, 0711); err != nil {
+		if err := sys.MkdirAllWithACL(config.TempDir, 0o711); err != nil {
 			return err
 		}
 		if runtime.GOOS == "windows" {