diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index defb77a10..1b6467eb2 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -512,6 +512,7 @@ std::pair<AutoCloseFD, Path> createTempFile(const Path & prefix)
     AutoCloseFD fd(mkstemp((char *) tmpl.c_str()));
     if (!fd)
         throw SysError("creating temporary file '%s'", tmpl);
+    closeOnExec(fd.get());
     return {std::move(fd), tmpl};
 }