diff --git a/nixos/modules/security/auditd.nix b/nixos/modules/security/auditd.nix
index 036ce9c01cae..67c661bb4394 100644
--- a/nixos/modules/security/auditd.nix
+++ b/nixos/modules/security/auditd.nix
@@ -229,7 +229,7 @@ in
         path = lib.getExe' pkgs.audit "audisp-af_unix";
         args = [
           "0640"
-          "/var/run/audispd_events"
+          "/run/audit/audispd_events"
           "string"
         ];
         format = "binary";
diff --git a/nixos/tests/audit.nix b/nixos/tests/audit.nix
index c5a69cc6e12a..d3fc558aeec8 100644
--- a/nixos/tests/audit.nix
+++ b/nixos/tests/audit.nix
@@ -40,7 +40,7 @@
       t.assertIn("backlog_limit 512", audit_status)
 
     with subtest("unix socket plugin activated"):
-      machine.succeed("stat /var/run/audispd_events")
+      machine.succeed("stat /run/audit/audispd_events")
 
     with subtest("Custom rule produces audit traces"):
       machine.succeed("hello")