diff --git a/lib/roken/simple_exec.c b/lib/roken/simple_exec.c
index cc3c5b47c..f3c4dabc3 100644
--- a/lib/roken/simple_exec.c
+++ b/lib/roken/simple_exec.c
@@ -197,6 +197,8 @@ pipe_execv(FILE **stdin_fd, FILE **stdout_fd, FILE **stderr_fd,
 	    close(err_fd[1]);
 	}
 
+	closefrom(2);
+
 	execv(file, argv);
 	exit((errno == ENOENT) ? EX_NOTFOUND : EX_NOEXEC);
     case -1: