diff --git a/src/modules/module-protocol-pulse/server.c b/src/modules/module-protocol-pulse/server.c
index 637757dfd..bf9b711a7 100644
--- a/src/modules/module-protocol-pulse/server.c
+++ b/src/modules/module-protocol-pulse/server.c
@@ -614,7 +614,7 @@ static int start_unix_server(struct server *server, const struct sockaddr_storag
 		goto error;
 	}
 
-	if (stat(addr_un->sun_path, &socket_stat) < 0) {
+	if (lstat(addr_un->sun_path, &socket_stat) < 0) {
 		if (errno != ENOENT) {
 			res = -errno;
 			pw_log_warn("server %p: stat('%s') failed: %m",
@@ -622,6 +622,12 @@ static int start_unix_server(struct server *server, const struct sockaddr_storag
 			goto error_close;
 		}
 	}
+	else if (S_ISLNK(socket_stat.st_mode)) {
+		res = -EACCES;
+		pw_log_error("server %p: refusing to follow symlink at '%s'",
+			    server, addr_un->sun_path);
+		goto error_close;
+	}
 	else if (socket_stat.st_mode & S_IWUSR || socket_stat.st_mode & S_IWGRP) {
 		if (!S_ISSOCK(socket_stat.st_mode)) {
 			res = -EEXIST;