diff --git a/run-command.c b/run-command.c
index 3449db319b95d1..67149d61d8f30b 100644
--- a/run-command.c
+++ b/run-command.c
@@ -966,18 +966,24 @@ int start_command(struct child_process *cmd)
 		return -1;
 	}
 
-	if (need_in)
+	if (need_in) {
 		close(fdin[0]);
+		set_cloexec(fdin[1]);
+	}
 	else if (cmd->in)
 		close(cmd->in);
 
-	if (need_out)
+	if (need_out) {
 		close(fdout[1]);
+		set_cloexec(fdout[0]);
+	}
 	else if (cmd->out)
 		close(cmd->out);
 
-	if (need_err)
+	if (need_err) {
 		close(fderr[1]);
+		set_cloexec(fderr[0]);
+	}
 	else if (cmd->err)
 		close(cmd->err);