diff --git a/lib/hx509/ks_dir.c b/lib/hx509/ks_dir.c
index 15d44982c..17a3ae474 100644
--- a/lib/hx509/ks_dir.c
+++ b/lib/hx509/ks_dir.c
@@ -116,6 +116,7 @@ dir_iter_start(hx509_context context,
 	free(d);
 	return errno;
     }
+    rk_cloexec(dirfd(d->dir));
     d->certs = NULL;
     d->iter = NULL;