diff --git a/src/Compositor.cpp b/src/Compositor.cpp
index ea8d38914..1cadb48d9 100644
--- a/src/Compositor.cpp
+++ b/src/Compositor.cpp
@@ -140,6 +140,7 @@ static void handleUserSignal(int sig) {
 
 bool CCompositor::setWatchdogFd(int fd) {
     m_watchdogWriteFd = Hyprutils::OS::CFileDescriptor{fd};
+    m_watchdogWriteFd.setFlags(m_watchdogWriteFd.getFlags() | O_CLOEXEC);
     return m_watchdogWriteFd.isValid() && !m_watchdogWriteFd.isClosed();
 }
 
diff --git a/src/config/shared/inotify/ConfigWatcher.cpp b/src/config/shared/inotify/ConfigWatcher.cpp
index c10039e48..3c2d15a79 100644
--- a/src/config/shared/inotify/ConfigWatcher.cpp
+++ b/src/config/shared/inotify/ConfigWatcher.cpp
@@ -27,7 +27,7 @@ CConfigWatcher::CConfigWatcher() : m_inotifyFd(inotify_init()) {
 
     // TODO: make CFileDescriptor take F_GETFL, F_SETFL
     const int FLAGS = fcntl(m_inotifyFd.get(), F_GETFL, 0);
-    if (fcntl(m_inotifyFd.get(), F_SETFL, FLAGS | O_NONBLOCK) < 0) {
+    if (fcntl(m_inotifyFd.get(), F_SETFL, FLAGS | O_NONBLOCK | O_CLOEXEC) < 0) {
         Log::logger->log(Log::ERR, "CConfigWatcher couldn't non-block inotify node. Config will not be automatically reloaded");
         m_inotifyFd.reset();
         return;
diff --git a/start/src/core/Instance.cpp b/start/src/core/Instance.cpp
index ef758422a..860cc49d9 100644
--- a/start/src/core/Instance.cpp
+++ b/start/src/core/Instance.cpp
@@ -155,6 +155,10 @@ bool CHyprlandInstance::run(bool safeMode) {
     m_wakeupRead  = CFileDescriptor{pipefds[0]};
     m_wakeupWrite = CFileDescriptor{pipefds[1]};
 
+    m_fromHlPid.setFlags(m_fromHlPid.getFlags() | O_CLOEXEC);
+    m_wakeupRead.setFlags(m_wakeupRead.getFlags() | O_CLOEXEC);
+    m_wakeupWrite.setFlags(m_wakeupWrite.getFlags() | O_CLOEXEC);
+
     runHyprlandThread(safeMode);
 
     pollfd pollfds[2] = {