diff --git a/lib/hx509/softp11.c b/lib/hx509/softp11.c
index c0acb9e11..4b7a28f8e 100644
--- a/lib/hx509/softp11.c
+++ b/lib/hx509/softp11.c
@@ -756,8 +756,11 @@ read_conf_file(const char *fn, CK_USER_TYPE userType, const char *pin)
 
 	    if (strcasecmp(name, "stdout") == 0)
 		soft_token.logfile = stdout;
-	    else
+	    else {
 		soft_token.logfile = fopen(name, "a");
+		if (soft_token.logfile)
+		    rk_cloexec_file(soft_token.logfile);
+	    }
 	    if (soft_token.logfile == NULL)
 		st_logf("failed to open file: %s\n", name);