diff --git a/experimental/clashapi/cachefile/cache.go b/experimental/clashapi/cachefile/cache.go
index 0b96fa5d..09118297 100644
--- a/experimental/clashapi/cachefile/cache.go
+++ b/experimental/clashapi/cachefile/cache.go
@@ -1,6 +1,7 @@
 package cachefile
 
 import (
+	"context"
 	"errors"
 	"net/netip"
 	"os"
@@ -13,6 +14,7 @@ import (
 	"github.com/sagernet/sing-box/adapter"
 	"github.com/sagernet/sing/common"
 	E "github.com/sagernet/sing/common/exceptions"
+	"github.com/sagernet/sing/service/filemanager"
 )
 
 var (
@@ -41,7 +43,7 @@ type CacheFile struct {
 	saveMetadataTimer *time.Timer
 }
 
-func Open(path string, cacheID string) (*CacheFile, error) {
+func Open(ctx context.Context, path string, cacheID string) (*CacheFile, error) {
 	const fileMode = 0o666
 	options := bbolt.Options{Timeout: time.Second}
 	var (
@@ -67,6 +69,10 @@ func Open(path string, cacheID string) (*CacheFile, error) {
 	if err != nil {
 		return nil, err
 	}
+	err = filemanager.Chown(ctx, path)
+	if err != nil {
+		return nil, E.Cause(err, "platform chown")
+	}
 	var cacheIDBytes []byte
 	if cacheID != "" {
 		cacheIDBytes = append([]byte{0}, []byte(cacheID)...)
diff --git a/experimental/clashapi/server.go b/experimental/clashapi/server.go
index 9ac06620..9f4b0f7c 100644
--- a/experimental/clashapi/server.go
+++ b/experimental/clashapi/server.go
@@ -147,7 +147,7 @@ func NewServer(ctx context.Context, router adapter.Router, logFactory log.Observ
 
 func (s *Server) PreStart() error {
 	if s.cacheFilePath != "" {
-		cacheFile, err := cachefile.Open(s.cacheFilePath, s.cacheID)
+		cacheFile, err := cachefile.Open(s.ctx, s.cacheFilePath, s.cacheID)
 		if err != nil {
 			return E.Cause(err, "open cache file")
 		}