diff --git a/cli-plugins/socket/socket.go b/cli-plugins/socket/socket.go
index fc91e78d8f..7096b42b2e 100644
--- a/cli-plugins/socket/socket.go
+++ b/cli-plugins/socket/socket.go
@@ -9,6 +9,8 @@ import (
 	"os"
 	"runtime"
 	"sync"
+
+	"github.com/sirupsen/logrus"
 )
 
 // EnvKey represents the well-known environment variable used to pass the
@@ -30,6 +32,7 @@ func NewPluginServer(h func(net.Conn)) (*PluginServer, error) {
 	if err != nil {
 		return nil, err
 	}
+	logrus.Trace("Plugin server listening on ", l.Addr())
 
 	if h == nil {
 		h = func(net.Conn) {}
@@ -92,6 +95,7 @@ func (pl *PluginServer) Addr() net.Addr {
 //
 // The error value is that of the underlying [net.Listner.Close] call.
 func (pl *PluginServer) Close() error {
+	logrus.Trace("Closing plugin server")
 	// Close connections first to ensure the connections get io.EOF instead
 	// of a connection reset.
 	pl.closeAllConns()
@@ -107,6 +111,10 @@ func (pl *PluginServer) closeAllConns() {
 	pl.mu.Lock()
 	defer pl.mu.Unlock()
 
+	if pl.closed {
+		return
+	}
+
 	// Prevent new connections from being accepted.
 	pl.closed = true
 
diff --git a/cmd/docker/docker.go b/cmd/docker/docker.go
index f5dad2ec79..3cf0ba966f 100644
--- a/cmd/docker/docker.go
+++ b/cmd/docker/docker.go
@@ -245,6 +245,11 @@ func tryPluginRun(ctx context.Context, dockerCli command.Cli, cmd *cobra.Command
 	if err == nil {
 		plugincmd.Env = append(plugincmd.Env, socket.EnvKey+"="+srv.Addr().String())
 	}
+	defer func() {
+		// Close the server when plugin execution is over, so that in case
+		// it's still open, any sockets on the filesystem are cleaned up.
+		_ = srv.Close()
+	}()
 
 	// Set additional environment variables specified by the caller.
 	plugincmd.Env = append(plugincmd.Env, envs...)