diff --git a/CHANGELOG.md b/CHANGELOG.md
index ba28875b7119e..23f98bdcde81c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 ## [Unreleased 3.x]
 ### Added
 - Support expected cluster name with validation in CCS Sniff mode ([#20532](https://github.com/opensearch-project/OpenSearch/pull/20532))
+- Add security policy to allow `accessUnixDomainSocket` in `transport-grpc` module ([#20463](https://github.com/opensearch-project/OpenSearch/pull/20463))
 
 ### Changed
 
diff --git a/modules/transport-grpc/src/main/plugin-metadata/plugin-security.policy b/modules/transport-grpc/src/main/plugin-metadata/plugin-security.policy
index 398de576b6c5a..394379e3d85f7 100644
--- a/modules/transport-grpc/src/main/plugin-metadata/plugin-security.policy
+++ b/modules/transport-grpc/src/main/plugin-metadata/plugin-security.policy
@@ -15,4 +15,7 @@ grant codeBase "${codebase.grpc-netty-shaded}" {
 
    // Netty sets custom classloader for some of its internal threads
    permission java.lang.RuntimePermission "*", "setContextClassLoader";
+
+   // Netty on Windows uses WEPollSelectorImpl which needs to delete temporary socket files
+   permission java.net.NetPermission "accessUnixDomainSocket";
 };