diff --git a/microdroid_manager/src/main.rs b/microdroid_manager/src/main.rs
index 1e1a609..be86247 100644
--- a/microdroid_manager/src/main.rs
+++ b/microdroid_manager/src/main.rs
@@ -38,11 +38,10 @@
 use glob::glob;
 use itertools::sorted;
 use libc::VMADDR_CID_HOST;
-use log::{error, info, warn};
+use log::{error, info};
 use keystore2_crypto::ZVec;
 use microdroid_metadata::{write_metadata, Metadata, PayloadMetadata};
 use microdroid_payload_config::{OsConfig, Task, TaskType, VmPayloadConfig};
-use nix::fcntl::{fcntl, F_SETFD, FdFlag};
 use nix::sys::signal::Signal;
 use openssl::sha::Sha512;
 use payload::{get_apex_data_from_payload, load_metadata, to_metadata};
@@ -191,11 +190,11 @@
     })
 }
 
-fn set_cloexec_on_vm_payload_service_socket() -> Result<()> {
-    let fd = android_get_control_socket(VM_PAYLOAD_SERVICE_SOCKET_NAME)?;
+fn prepare_vm_payload_service_socket() -> Result<()> {
+    android_get_control_socket(VM_PAYLOAD_SERVICE_SOCKET_NAME)?;
 
-    fcntl(fd, F_SETFD(FdFlag::FD_CLOEXEC))?;
-
+    // TODO(b/275729094): Convert the obtained file descriptor to `OwnedFd`
+    //  and use it to set the `RpcServer`.
     Ok(())
 }
 
@@ -203,9 +202,11 @@
     let _ignored = kernlog::init();
     info!("started.");
 
-    if let Err(e) = set_cloexec_on_vm_payload_service_socket() {
-        warn!("Failed to set cloexec on vm payload socket: {:?}", e);
-    }
+    // To ensure that the CLOEXEC flag is set on the file descriptor as early as possible,
+    // it is necessary to fetch the socket corresponding to vm_payload_service at the
+    // very beginning, as android_get_control_socket() sets the CLOEXEC flag on the file
+    // descriptor.
+    prepare_vm_payload_service_socket()?;
 
     load_crashkernel_if_supported().context("Failed to load crashkernel")?;