diff --git a/lib/gssapi/mech/gss_mech_switch.c b/lib/gssapi/mech/gss_mech_switch.c
index ddd05d011..40229f98c 100644
--- a/lib/gssapi/mech/gss_mech_switch.c
+++ b/lib/gssapi/mech/gss_mech_switch.c
@@ -229,6 +229,7 @@ _gss_load_mech(void)
 		HEIMDAL_MUTEX_unlock(&_gss_mech_mutex);
 		return;
 	}
+	rk_cloexec_file(fp);
 
 	while (fgets(buf, sizeof(buf), fp)) {
 		if (*buf == '#')