diff --git a/lib/hcrypto/rand-unix.c b/lib/hcrypto/rand-unix.c
index a5908a0e1..eaa81b0f1 100644
--- a/lib/hcrypto/rand-unix.c
+++ b/lib/hcrypto/rand-unix.c
@@ -63,8 +63,10 @@ get_device_fd(int flags)
 
     for(p = rnd_devices; *p; p++) {
 	int fd = open(*p, flags | O_NDELAY);
-	if(fd >= 0)
+	if(fd >= 0) {
+	    rk_cloexec(fd);
 	    return fd;
+	}
     }
     return -1;
 }