diff --git a/src/listener.c b/src/listener.c
index fb2306927..a730b1832 100644
--- a/src/listener.c
+++ b/src/listener.c
@@ -545,7 +545,7 @@ void listener_accept(int fd)
 		/* with sockpair@ we don't want to do an accept */
 		if (unlikely(l->addr.ss_family == AF_CUST_SOCKPAIR)) {
 			if ((cfd = recv_fd_uxst(fd)) != -1)
-				fcntl(cfd, F_SETFL, O_NONBLOCK);
+				fcntl(cfd, F_SETFL, O_NONBLOCK|O_CLOEXEC);
 		} else
 
 #ifdef USE_ACCEPT4
@@ -553,12 +553,12 @@ void listener_accept(int fd)
 		 * fallback to the legacy accept() + fcntl().
 		 */
 		if (unlikely(accept4_broken ||
-			((cfd = accept4(fd, (struct sockaddr *)&addr, &laddr, SOCK_NONBLOCK)) == -1 &&
+			((cfd = accept4(fd, (struct sockaddr *)&addr, &laddr, SOCK_NONBLOCK|SOCK_CLOEXEC)) == -1 &&
 			(errno == ENOSYS || errno == EINVAL || errno == EBADF) &&
 			(accept4_broken = 1))))
 #endif
 			if ((cfd = accept(fd, (struct sockaddr *)&addr, &laddr)) != -1)
-				fcntl(cfd, F_SETFL, O_NONBLOCK);
+				fcntl(cfd, F_SETFL, O_NONBLOCK|O_CLOEXEC);
 
 		if (unlikely(cfd == -1)) {
 			switch (errno) {