diff --git a/src/backends/profile-support.ts b/src/backends/profile-support.ts
index c354131..d6a2764 100644
--- a/src/backends/profile-support.ts
+++ b/src/backends/profile-support.ts
@@ -2128,8 +2128,7 @@ function stableTmpRoot(): string {
   if (home) {
     try {
       const cache = join(home, '.cache')
-      // Don't mkdir — cli-bridge runs on hosts that always have
-      // ~/.cache (we don't ship a polyfill for first-boot Linux).
+      mkdirSync(cache, { recursive: true, mode: 0o700 })
       return cache
     } catch {
       // fallthrough