diff --git a/internal/third_party/dep/fs/fs.go b/internal/third_party/dep/fs/fs.go
index 4a8a736f7..5502e25d4 100644
--- a/internal/third_party/dep/fs/fs.go
+++ b/internal/third_party/dep/fs/fs.go
@@ -132,6 +132,10 @@ func CopyDir(src, dst string) error {
 		srcPath := filepath.Join(src, entry.Name())
 		dstPath := filepath.Join(dst, entry.Name())
 
+		if entry.Type()&os.ModeSocket != 0 {
+			continue
+		}
+
 		if entry.IsDir() {
 			if err = CopyDir(srcPath, dstPath); err != nil {
 				return fmt.Errorf("copying directory failed: %w", err)
diff --git a/internal/third_party/dep/fs/fs_test.go b/internal/third_party/dep/fs/fs_test.go
index eb910d6c7..62595cb23 100644
--- a/internal/third_party/dep/fs/fs_test.go
+++ b/internal/third_party/dep/fs/fs_test.go
@@ -32,6 +32,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 package fs
 
 import (
+	"net"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -118,6 +119,30 @@ func TestCopyDir(t *testing.T) {
 	}
 }
 
+func TestCopyDirSkipsSocket(t *testing.T) {
+	dir := t.TempDir()
+	srcdir := filepath.Join(dir, "src")
+	require.NoError(t, os.MkdirAll(srcdir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(srcdir, "file"), []byte("contents"), 0o644))
+
+	socketPath := filepath.Join(srcdir, "socket")
+	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "unix", socketPath)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		require.NoError(t, listener.Close())
+	})
+
+	destdir := filepath.Join(dir, "dest")
+	require.NoError(t, CopyDir(srcdir, destdir))
+
+	contents, err := os.ReadFile(filepath.Join(destdir, "file"))
+	require.NoError(t, err)
+	require.Equal(t, "contents", string(contents))
+
+	_, err = os.Lstat(filepath.Join(destdir, "socket"))
+	require.ErrorIs(t, err, os.ErrNotExist)
+}
+
 func TestCopyDirFail_SrcInaccessible(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		// XXX: setting permissions works differently in