diff --git a/internal/daemon/common/client_ip.go b/internal/daemon/common/client_ip.go
index 9a55b3a83..60ffa492c 100644
--- a/internal/daemon/common/client_ip.go
+++ b/internal/daemon/common/client_ip.go
@@ -34,6 +34,12 @@ func ClientIpFromRequest(ctx context.Context, listenerCfg *listenerutil.Listener
 		if err != nil {
 			return "", errors.Wrap(ctx, err, op)
 		}
+		if listenerCfg.Type == "unix" && ip == "" {
+			// Some platforms (Linux) use "@" in this case but some like Mac
+			// leave it empty which causes issues with the rate limiting logic,
+			// so standardize on "@" in this case.
+			return "@", nil
+		}
 		return ip, nil
 	case trustedForwardedFor == nil && remoteAddr != nil:
 		// not reachable given listenerutil.TrustedFromXForwardedFor