CHDIR is the directory, not the binary. Check that every parent is +x for that user. /srv is often 750 root:staff. Also if ProtectHome or ReadOnlyPaths still points at /opt/old, drop those in a drop-in, do not edit the vendor unit.
Moved the app from /opt/old to /srv/app. Updated WorkingDirectory and ExecStart. daemon-reload, restart — status is failed, code=exited, status=200/CHDIR. The path exists, owned by the service user. What am I missing?