diff --git a/libc/dns/resolv/res_init.c b/libc/dns/resolv/res_init.c
index 9f3a9da..158466e 100644
--- a/libc/dns/resolv/res_init.c
+++ b/libc/dns/resolv/res_init.c
@@ -611,7 +611,7 @@
 static int
 real_randomid(u_int *random_value) {
 	/* open the nonblocking random device, returning -1 on failure */
-	int random_device = open("/dev/urandom", O_RDONLY);
+	int random_device = open("/dev/urandom", O_RDONLY | O_CLOEXEC);
 	if (random_device < 0) {
 		return -1;
 	}