diff --git a/customize/urandom.ml b/customize/urandom.ml
index 3686f77d2..fd8cc8e8f 100644
--- a/customize/urandom.ml
+++ b/customize/urandom.ml
@@ -26,7 +26,7 @@
 
 open Unix
 
-let open_urandom_fd () = openfile "/dev/urandom" [O_RDONLY] 0
+let open_urandom_fd () = openfile "/dev/urandom" [O_RDONLY; O_CLOEXEC] 0
 
 let read_byte fd =
   let b = Bytes.make 1 ' ' in