diff --git a/lib/hx509/ks_file.c b/lib/hx509/ks_file.c
index e04ce0ac1..bb8dce3a4 100644
--- a/lib/hx509/ks_file.c
+++ b/lib/hx509/ks_file.c
@@ -526,6 +526,7 @@ file_store(hx509_context context,
 			       "Failed to open file %s for writing");
 	return ENOENT;
     }
+    rk_cloexec_file(sc.f);
     sc.format = f->format;
 
     ret = hx509_certs_iter(context, f->certs, store_func, &sc);