diff --git a/pbs-client/src/pxar/dir_stack.rs b/pbs-client/src/pxar/dir_stack.rs
index 616d7545..6fe55f17 100644
--- a/pbs-client/src/pxar/dir_stack.rs
+++ b/pbs-client/src/pxar/dir_stack.rs
@@ -57,7 +57,7 @@ impl PxarDir {
         let dir = Dir::openat(
             parent,
             self.file_name.as_os_str(),
-            OFlag::O_DIRECTORY,
+            OFlag::O_DIRECTORY | OFlag::O_CLOEXEC,
             Mode::empty(),
         )?;
 
diff --git a/pbs-datastore/src/backup_info.rs b/pbs-datastore/src/backup_info.rs
index a92c4782..ef2b982c 100644
--- a/pbs-datastore/src/backup_info.rs
+++ b/pbs-datastore/src/backup_info.rs
@@ -143,7 +143,7 @@ impl BackupGroup {
                 match openat(
                     l2_fd,
                     &manifest_path,
-                    OFlag::O_RDONLY,
+                    OFlag::O_RDONLY | OFlag::O_CLOEXEC,
                     nix::sys::stat::Mode::empty(),
                 ) {
                     Ok(rawfd) => {
diff --git a/pbs-datastore/src/snapshot_reader.rs b/pbs-datastore/src/snapshot_reader.rs
index 83a1a079..b9c3d931 100644
--- a/pbs-datastore/src/snapshot_reader.rs
+++ b/pbs-datastore/src/snapshot_reader.rs
@@ -102,7 +102,7 @@ impl SnapshotReader {
         let raw_fd = nix::fcntl::openat(
             self.locked_dir.as_raw_fd(),
             Path::new(filename),
-            nix::fcntl::OFlag::O_RDONLY,
+            nix::fcntl::OFlag::O_RDONLY | nix::fcntl::OFlag::O_CLOEXEC,
             nix::sys::stat::Mode::empty(),
         )?;
         let file = unsafe { File::from_raw_fd(raw_fd) };