diff --git a/modules/programs/tmux.nix b/modules/programs/tmux.nix
index b436948bb..b65da1b14 100644
--- a/modules/programs/tmux.nix
+++ b/modules/programs/tmux.nix
@@ -251,7 +251,7 @@ in
           ++ optional cfg.tmuxinator.enable pkgs.tmuxinator
           ++ optional cfg.tmuxp.enable      pkgs.tmuxp;
 
-          home.file.".tmux.conf".text = tmuxConf;
+        home.file.".tmux.conf".text = tmuxConf;
       }
 
       (mkIf cfg.sensibleOnTop {
@@ -264,6 +264,12 @@ in
         '';
       })
 
+      (mkIf cfg.secureSocket {
+        home.sessionVariables = {
+          TMUX_TMPDIR = ''''${XDG_RUNTIME_DIR:-"/run/user/\$(id -u)"}'';
+        };
+      })
+
       (mkIf (cfg.plugins != []) {
         assertions = [(
           let
diff --git a/tests/modules/programs/tmux/default.nix b/tests/modules/programs/tmux/default.nix
index 5bc311772..16d6d63e4 100644
--- a/tests/modules/programs/tmux/default.nix
+++ b/tests/modules/programs/tmux/default.nix
@@ -2,4 +2,5 @@
   tmux-emacs-with-plugins = ./emacs-with-plugins.nix;
   tmux-not-enabled = ./not-enabled.nix;
   tmux-vi-all-true = ./vi-all-true.nix;
+  tmux-secure-socket-enabled = ./secure-socket-enabled.nix;
 }
diff --git a/tests/modules/programs/tmux/hm-session-vars.sh b/tests/modules/programs/tmux/hm-session-vars.sh
new file mode 100644
index 000000000..40d9c24b5
--- /dev/null
+++ b/tests/modules/programs/tmux/hm-session-vars.sh
@@ -0,0 +1,5 @@
+# Only source this once.
+if [ -n "$__HM_SESS_VARS_SOURCED" ]; then return; fi
+export __HM_SESS_VARS_SOURCED=1
+
+export TMUX_TMPDIR="${XDG_RUNTIME_DIR:-"/run/user/\$(id -u)"}"
diff --git a/tests/modules/programs/tmux/secure-socket-enabled.nix b/tests/modules/programs/tmux/secure-socket-enabled.nix
new file mode 100644
index 000000000..34e9129c5
--- /dev/null
+++ b/tests/modules/programs/tmux/secure-socket-enabled.nix
@@ -0,0 +1,17 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+  config = {
+    programs.tmux = {
+      enable = true;
+      secureSocket = true;
+    };
+
+    nmt.script = ''
+      assertFileExists home-path/etc/profile.d/hm-session-vars.sh
+      assertFileContent home-path/etc/profile.d/hm-session-vars.sh ${./hm-session-vars.sh}
+    '';
+  };
+}