diff --git a/lib/libfetch/common.c b/lib/libfetch/common.c
index ff10d27b419e..fefc4c5defd6 100644
--- a/lib/libfetch/common.c
+++ b/lib/libfetch/common.c
@@ -213,6 +213,7 @@ fetch_reopen(int sd)
 	/* allocate and fill connection structure */
 	if ((conn = calloc(1, sizeof(*conn))) == NULL)
 		return (NULL);
+	fcntl(sd, F_SETFD, FD_CLOEXEC);
 	conn->sd = sd;
 	++conn->ref;
 	return (conn);
diff --git a/lib/libfetch/file.c b/lib/libfetch/file.c
index a1492ba05637..dffaad8278fb 100644
--- a/lib/libfetch/file.c
+++ b/lib/libfetch/file.c
@@ -33,6 +33,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/stat.h>
 
 #include <dirent.h>
+#include <fcntl.h>
 #include <stdio.h>
 #include <string.h>
 
@@ -57,6 +58,7 @@ fetchXGetFile(struct url *u, struct url_stat *us, const char *flags)
 		fetch_syserr();
 	}
 
+	fcntl(fileno(f), F_SETFD, FD_CLOEXEC);
 	return (f);
 }
 
@@ -84,6 +86,7 @@ fetchPutFile(struct url *u, const char *flags)
 		fetch_syserr();
 	}
 
+	fcntl(fileno(f), F_SETFD, FD_CLOEXEC);
 	return (f);
 }