diff --git a/Cargo.lock b/Cargo.lock
index 0715098c..f84594b2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -948,6 +948,12 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
+[[package]]
+name = "cfg_aliases"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
+
 [[package]]
 name = "chacha20"
 version = "0.10.1"
@@ -3250,6 +3256,18 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b"
 
+[[package]]
+name = "nix"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
+dependencies = [
+ "bitflags 2.13.0",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
 [[package]]
 name = "nom"
 version = "7.1.3"
@@ -5930,6 +5948,7 @@ dependencies = [
  "macros",
  "mimalloc",
  "moka",
+ "nix",
  "num-derive",
  "num-traits",
  "opendal",
diff --git a/Cargo.toml b/Cargo.toml
index 909570e7..ac9dc77e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -60,6 +60,8 @@ unstable = []
 [target."cfg(unix)".dependencies]
 # Logging
 syslog = "7.0.0"
+# Filesystem access checks (e.g. sendmail executability for the current user)
+nix = { version = "0.30.1", default-features = false, features = ["fs"] }
 
 [dependencies]
 macros = { path = "./macros" }
diff --git a/src/config.rs b/src/config.rs
index 49281b6c..7bda3199 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -1135,8 +1135,8 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
 
                     #[cfg(unix)]
                     {
-                        use std::os::unix::fs::PermissionsExt;
-                        if !metadata.permissions().mode() & 0o111 != 0 {
+                        // Check actual execute permission for the current process, not just mode bits.
+                        if nix::unistd::access(&path, nix::unistd::AccessFlags::X_OK).is_err() {
                             err!(format!("sendmail command at `{path:?}` isn't executable"));
                         }
                     }