diff --git a/jupyter_rsession_proxy/__init__.py b/jupyter_rsession_proxy/__init__.py
index 59e85be..4865520 100644
--- a/jupyter_rsession_proxy/__init__.py
+++ b/jupyter_rsession_proxy/__init__.py
@@ -93,7 +93,10 @@ def _get_cmd(port, unix_socket):
 
         # use mkdtemp() so the directory and its contents don't vanish when
         # we're out of scope
-        server_data_dir = tempfile.mkdtemp()
+        # we create the server_data_dir inside another temp dir,
+        # as rserver seems to insists on changing its permissions to 777.
+        # wrapping it in the first tempdir inside the contents of server_data_dir stay secure.
+        server_data_dir = tempfile.mkdtemp(dir=tempfile.mkdtemp())
         database_config_file = db_config(server_data_dir)
 
         cmd = [