diff --git a/localapi/access_unix_test.go b/localapi/access_unix_test.go
index 0467691c..19b9aea6 100644
--- a/localapi/access_unix_test.go
+++ b/localapi/access_unix_test.go
@@ -159,7 +159,6 @@ func TestInfoAccessFromConfig(t *testing.T) {
 	cfg, err := load(section("    group: " + name + "\n"))
 	require.NoError(t, err)
 	assert.Equal(t, os.FileMode(0660), cfg.Access.Mode)
-	require.NotNil(t, cfg.Access.Group)
 	assert.Equal(t, gid, cfg.Access.Group.ID)
 
 	cfg, err = load(section("    group: " + name + "\n    socket_mode: \"0664\"\n"))
@@ -172,8 +171,7 @@ func TestInfoAccessFromConfig(t *testing.T) {
 
 	cfg, err = load(section(""))
 	require.NoError(t, err)
-	assert.Equal(t, os.FileMode(0600), cfg.Access.Mode)
-	assert.Nil(t, cfg.Access.Group)
+	assert.Equal(t, ownerOnly(), cfg.Access)
 }
 
 // TestRemovingTheGroupHandsTheSocketBack: a reload that drops the group key leaves the
diff --git a/localapi/info.go b/localapi/info.go
index f71e0444..e27b3cf9 100644
--- a/localapi/info.go
+++ b/localapi/info.go
@@ -36,11 +36,6 @@ const (
 )
 
 const (
-	// defaultInfoMode is the socket's mode when the config names neither a mode nor a
-	// group: the daemon's user alone, so that enabling the API does not open it to
-	// anyone until the operator says who. Naming a group makes it groupSocketMode.
-	defaultInfoMode os.FileMode = 0600
-
 	// infoMaxConns bounds the connections held open at once. Beyond it the kernel
 	// queues, which is what an HTTP client expects of a busy server; the control socket
 	// refuses instead because its clients are people at a prompt.
@@ -412,8 +407,10 @@ func infoConfigFrom(c *config.C) (infoConfig, error) {
 	if err != nil {
 		return cfg, err
 	}
-	def := defaultInfoMode
-	if group != nil {
+	// With neither a mode nor a group named, the daemon's user alone, so that enabling
+	// the API does not open it to anyone until the operator says who.
+	def := ownerOnlyMode
+	if group.ID != "" {
 		def = groupSocketMode
 	}
 
@@ -424,7 +421,7 @@ func infoConfigFrom(c *config.C) (infoConfig, error) {
 	// On unix the mode is what admits the group, so one that shuts it out is a config
 	// error; on windows the group is an entry in the pipe's security descriptor and the
 	// mode means nothing to a pipe, so it is not held against the group there.
-	if runtime.GOOS != "windows" && group != nil && mode&0070 == 0 {
+	if runtime.GOOS != "windows" && group.ID != "" && mode&0070 == 0 {
 		return cfg, fmt.Errorf("%s %s gives group %s no access to the socket; use \"%04o\" or leave the mode unset", InfoModeKey, modeString(mode), group.Name, mode|0060)
 	}
 	cfg.Access = Access{Mode: mode, Group: group}
diff --git a/localapi/info_windows_test.go b/localapi/info_windows_test.go
index e214168f..a9f437cf 100644
--- a/localapi/info_windows_test.go
+++ b/localapi/info_windows_test.go
@@ -24,7 +24,7 @@ import (
 func TestInfoIsServedOnAPipe(t *testing.T) {
 	users, err := windows.CreateWellKnownSid(windows.WinBuiltinUsersSid)
 	require.NoError(t, err)
-	group := &Group{Name: "Users", ID: users.String()}
+	group := Group{Name: "Users", ID: users.String()}
 
 	s := NewInfoServer(test.NewLogger(), commands.New())
 	path := pipePrefix + "nebula-info-test"