diff --git a/lib/krb5/v4_glue.c b/lib/krb5/v4_glue.c
index b92bde077..97f0dd62f 100644
--- a/lib/krb5/v4_glue.c
+++ b/lib/krb5/v4_glue.c
@@ -162,6 +162,7 @@ write_v4_cc(krb5_context context, const char *tkfile,
 	free(path);
 	return ret;
     }
+    rk_cloexec(fd);
 
     if (fstat(fd, &sb) != 0 || !S_ISREG(sb.st_mode)) {
 	krb5_set_error_message(context, ret,