diff --git a/internal/daemon/snapshot-format.yaml b/internal/daemon/snapshot-format.yaml
index 769c698ee..8a43fab79 100644
--- a/internal/daemon/snapshot-format.yaml
+++ b/internal/daemon/snapshot-format.yaml
@@ -51,7 +51,7 @@ test-sdk-2:
     snapshot-sdk: 2
   fs-calls: 12
   exec-calls:
-    - ["sudo", "--user=#0", "--group=#0", "--preserve-env=SDK", "--preserve-env=WORKSHOP_COOKIE", "--", "bash", "-l", "-c", 'exec -- "$0" "$@"', "bash", "-o", "errexit", "-o", "pipefail", "/var/lib/workshop/sdk/test-sdk-2/sdk/hooks/setup-base"]
+    - ["sudo", "--user=#0", "--group=#0", "--preserve-env=SDK", "--preserve-env=SDK_SYSTEMD_SECRET_SOCKET", "--preserve-env=WORKSHOP_COOKIE", "--", "bash", "-l", "-c", 'exec -- "$0" "$@"', "bash", "-o", "errexit", "-o", "pipefail", "/var/lib/workshop/sdk/test-sdk-2/sdk/hooks/setup-base"]
 test-sdk:
   files:
     - drwxr-xr-x var
@@ -70,8 +70,8 @@ test-sdk:
     snapshot-sdk: 3
   fs-calls: 16
   exec-calls:
-    - ["sudo", "--user=#0", "--group=#0", "--preserve-env=SDK", "--preserve-env=WORKSHOP_COOKIE", "--", "bash", "-l", "-c", 'exec -- "$0" "$@"', "bash", "-o", "errexit", "-o", "pipefail", "/var/lib/workshop/sdk/test-sdk-2/sdk/hooks/setup-base"]
-    - ["sudo", "--user=#0", "--group=#0", "--preserve-env=SDK", "--preserve-env=WORKSHOP_COOKIE", "--", "bash", "-l", "-c", 'exec -- "$0" "$@"', "bash", "-o", "errexit", "-o", "pipefail", "/var/lib/workshop/sdk/test-sdk/sdk/hooks/setup-base"]
+    - ["sudo", "--user=#0", "--group=#0", "--preserve-env=SDK", "--preserve-env=SDK_SYSTEMD_SECRET_SOCKET", "--preserve-env=WORKSHOP_COOKIE", "--", "bash", "-l", "-c", 'exec -- "$0" "$@"', "bash", "-o", "errexit", "-o", "pipefail", "/var/lib/workshop/sdk/test-sdk-2/sdk/hooks/setup-base"]
+    - ["sudo", "--user=#0", "--group=#0", "--preserve-env=SDK", "--preserve-env=SDK_SYSTEMD_SECRET_SOCKET", "--preserve-env=WORKSHOP_COOKIE", "--", "bash", "-l", "-c", 'exec -- "$0" "$@"', "bash", "-o", "errexit", "-o", "pipefail", "/var/lib/workshop/sdk/test-sdk/sdk/hooks/setup-base"]
 sketch:
   files:
     - drwxr-xr-x var
diff --git a/internal/overlord/hookstate/handlers.go b/internal/overlord/hookstate/handlers.go
index 5ad2d9b3a..2512ce7c8 100644
--- a/internal/overlord/hookstate/handlers.go
+++ b/internal/overlord/hookstate/handlers.go
@@ -84,7 +84,8 @@ func (h *HookManager) doRunHook(task *state.Task, tomb *tomb.Tomb) error {
 		GroupId: 0,
 		Command: command,
 		Environment: map[string]string{
-			"SDK": sdk.SdkDir(hook.Sdk),
+			"SDK":                       sdk.SdkDir(hook.Sdk),
+			"SDK_SYSTEMD_SECRET_SOCKET": dirs.WorkshopSecretSocketPath,
 		},
 		WorkDir: sdk.SdkHooksDir(hook.Sdk),
 		Timeout: hook.Timeout,
diff --git a/internal/overlord/hookstate/handlers_test.go b/internal/overlord/hookstate/handlers_test.go
index 358e277c8..b9bd6ae53 100644
--- a/internal/overlord/hookstate/handlers_test.go
+++ b/internal/overlord/hookstate/handlers_test.go
@@ -262,6 +262,7 @@ func (s *hookSuite) TestExecSetupProject(c *check.C) {
 		"--preserve-env=DBUS_SESSION_BUS_ADDRESS",
 		"--preserve-env=HOME",
 		"--preserve-env=SDK",
+		"--preserve-env=SDK_SYSTEMD_SECRET_SOCKET",
 		"--preserve-env=WORKSHOP_COOKIE",
 		"--preserve-env=XDG_RUNTIME_DIR",
 		"--",
@@ -325,10 +326,10 @@ func (s *hookSuite) TestExecSaveState(c *check.C) {
 
 	c.Check(s.backend.ExecCalls, check.HasLen, 1)
 	c.Assert(s.backend.ExecCalls[0].Args.Command, check.DeepEquals,
-		[]string{"sudo", "--user=#0", "--group=#0", "--preserve-env=SDK", "--preserve-env=SDK_STATE_DIR", "--preserve-env=WORKSHOP_COOKIE", "--", "bash", "-l", "-c", `exec -- "$0" "$@"`, "bash", "-o", "errexit", "-o", "pipefail", "/var/lib/workshop/sdk/one/sdk/hooks/save-state"})
+		[]string{"sudo", "--user=#0", "--group=#0", "--preserve-env=SDK", "--preserve-env=SDK_STATE_DIR", "--preserve-env=SDK_SYSTEMD_SECRET_SOCKET", "--preserve-env=WORKSHOP_COOKIE", "--", "bash", "-l", "-c", `exec -- "$0" "$@"`, "bash", "-o", "errexit", "-o", "pipefail", "/var/lib/workshop/sdk/one/sdk/hooks/save-state"})
 	c.Assert(s.backend.ExecCalls[0].Args.Environment["SDK_STATE_DIR"], check.Equals, "/var/lib/workshop/state/sdk/one")
 	c.Assert(s.backend.ExecCalls[0].Args.Environment["WORKSHOP_COOKIE"], check.NotNil)
-	c.Assert(s.backend.ExecCalls[0].Args.Environment, check.HasLen, 3)
+	c.Assert(s.backend.ExecCalls[0].Args.Environment, check.HasLen, 4)
 }
 
 func (s *hookSuite) TestExecRestoreState(c *check.C) {
@@ -360,10 +361,10 @@ func (s *hookSuite) TestExecRestoreState(c *check.C) {
 
 	c.Check(s.backend.ExecCalls, check.HasLen, 1)
 	c.Assert(s.backend.ExecCalls[0].Args.Command, check.DeepEquals,
-		[]string{"sudo", "--user=#0", "--group=#0", "--preserve-env=SDK", "--preserve-env=SDK_STATE_DIR", "--preserve-env=WORKSHOP_COOKIE", "--", "bash", "-l", "-c", `exec -- "$0" "$@"`, "bash", "-o", "errexit", "-o", "pipefail", "-o", "xtrace", "/var/lib/workshop/sdk/one/sdk/hooks/restore-state"})
+		[]string{"sudo", "--user=#0", "--group=#0", "--preserve-env=SDK", "--preserve-env=SDK_STATE_DIR", "--preserve-env=SDK_SYSTEMD_SECRET_SOCKET", "--preserve-env=WORKSHOP_COOKIE", "--", "bash", "-l", "-c", `exec -- "$0" "$@"`, "bash", "-o", "errexit", "-o", "pipefail", "-o", "xtrace", "/var/lib/workshop/sdk/one/sdk/hooks/restore-state"})
 	c.Assert(s.backend.ExecCalls[0].Args.Environment["SDK_STATE_DIR"], check.Equals, "/var/lib/workshop/state/sdk/one")
 	c.Assert(s.backend.ExecCalls[0].Args.Environment["WORKSHOP_COOKIE"], check.NotNil)
-	c.Assert(s.backend.ExecCalls[0].Args.Environment, check.HasLen, 3)
+	c.Assert(s.backend.ExecCalls[0].Args.Environment, check.HasLen, 4)
 }
 
 func (s *hookSuite) TestExecHandlesFailedHook(c *check.C) {
@@ -401,7 +402,7 @@ func (s *hookSuite) TestExecHandlesFailedHook(c *check.C) {
 
 	c.Check(s.backend.ExecCalls, check.HasLen, 1)
 	c.Assert(s.backend.ExecCalls[0].Args.Command, check.DeepEquals,
-		[]string{"sudo", "--user=#0", "--group=#0", "--preserve-env=SDK", "--preserve-env=SDK_STATE_DIR", "--preserve-env=WORKSHOP_COOKIE", "--", "bash", "-l", "-c", `exec -- "$0" "$@"`, "bash", "-o", "errexit", "-o", "pipefail", "/var/lib/workshop/sdk/one/sdk/hooks/save-state"})
+		[]string{"sudo", "--user=#0", "--group=#0", "--preserve-env=SDK", "--preserve-env=SDK_STATE_DIR", "--preserve-env=SDK_SYSTEMD_SECRET_SOCKET", "--preserve-env=WORKSHOP_COOKIE", "--", "bash", "-l", "-c", `exec -- "$0" "$@"`, "bash", "-o", "errexit", "-o", "pipefail", "/var/lib/workshop/sdk/one/sdk/hooks/save-state"})
 
 	c.Check(t1.Status(), check.Equals, state.ErrorStatus)
 	c.Check(t1.Log(), check.HasLen, 1)
@@ -441,7 +442,7 @@ func (s *hookSuite) TestExecHandlesHookTimedout(c *check.C) {
 
 	c.Check(s.backend.ExecCalls, check.HasLen, 1)
 	c.Assert(s.backend.ExecCalls[0].Args.Command, check.DeepEquals,
-		[]string{"sudo", "--user=#0", "--group=#0", "--preserve-env=SDK", "--preserve-env=WORKSHOP_COOKIE", "--", "bash", "-l", "-c", `exec -- "$0" "$@"`, "bash", "-o", "errexit", "-o", "pipefail", "/var/lib/workshop/sdk/one/sdk/hooks/fake-hook"})
+		[]string{"sudo", "--user=#0", "--group=#0", "--preserve-env=SDK", "--preserve-env=SDK_SYSTEMD_SECRET_SOCKET", "--preserve-env=WORKSHOP_COOKIE", "--", "bash", "-l", "-c", `exec -- "$0" "$@"`, "bash", "-o", "errexit", "-o", "pipefail", "/var/lib/workshop/sdk/one/sdk/hooks/fake-hook"})
 
 	c.Check(t1.Status(), check.Equals, state.ErrorStatus)
 	c.Check(t1.Log(), check.HasLen, 1)