diff --git a/cmd/tokidoki/main.go b/cmd/tokidoki/main.go
index 3b982f7..06b817c 100644
--- a/cmd/tokidoki/main.go
+++ b/cmd/tokidoki/main.go
@@ -5,8 +5,10 @@ import (
 	"encoding/base64"
 	"flag"
 	"fmt"
+	"net"
 	"net/http"
 	"os"
+	"strings"
 
 	"github.com/emersion/go-webdav"
 	"github.com/emersion/go-webdav/caldav"
@@ -163,6 +165,22 @@ func main() {
 	mux.Mount("/{user}/contacts", &carddavHandler)
 	mux.Mount("/{user}/calendar", &caldavHandler)
 
+	var ln net.Listener
+	if a := strings.TrimPrefix(addr, "unix://"); a != addr {
+		ln, err = net.Listen("unix", a)
+		if err != nil {
+			log.Fatal().Err(err).Msg("failed to listen")
+		}
+		if err = os.Chmod(a, 0775); err != nil {
+			log.Warn().Err(err).Msg("failed to set socket mode")
+		}
+	} else {
+		ln, err = net.Listen("tcp", addr)
+		if err != nil {
+			log.Fatal().Err(err).Msg("failed to listen")
+		}
+	}
+
 	server := http.Server{
 		Addr:    addr,
 		Handler: mux,
@@ -172,9 +190,9 @@ func main() {
 	log.Debug().Msg("debug output enabled")
 
 	if (cert != "") && (key != "") {
-		err = server.ListenAndServeTLS(cert, key)
+		err = server.ServeTLS(ln, cert, key)
 	} else {
-		err = server.ListenAndServe()
+		err = server.Serve(ln)
 	}
 	if err != http.ErrServerClosed {
 		log.Fatal().Err(err).Msg("ListenAndServe() error")
diff --git a/doc/tokidoki.8.scd b/doc/tokidoki.8.scd
index cf2220f..0ea5678 100644
--- a/doc/tokidoki.8.scd
+++ b/doc/tokidoki.8.scd
@@ -27,7 +27,7 @@ Regular logs are sent to stderr, HTTP logs are sent to stdout.
 
 *-addr* _addr_
 	Bind to the specified address/port. Default: ":8080" (port 8080 on all
-	interfaces.
+	interfaces. Use "unix:///path/to/socket" to bind to a Unix socket.
 
 *-auth.url* _url_
 	Auth backend URL (required). See AUTH BACKENDS below.