diff --git a/src/gst/gstpipewirecore.c b/src/gst/gstpipewirecore.c
index b01cd8a5c..9b553d180 100644
--- a/src/gst/gstpipewirecore.c
+++ b/src/gst/gstpipewirecore.c
@@ -26,6 +26,7 @@
 #include "config.h"
 #endif
 #include <unistd.h>
+#include <fcntl.h>
 
 #include <spa/utils/result.h>
 
@@ -83,7 +84,7 @@ static GstPipeWireCore *make_core (int fd)
   if (fd == -1)
     core->core = pw_context_connect (core->context, NULL, 0);
   else
-    core->core = pw_context_connect_fd (core->context, dup(fd), NULL, 0);
+    core->core = pw_context_connect_fd (core->context, fcntl(fd, F_DUPFD_CLOEXEC, 3), NULL, 0);
 
   if (core->core == NULL)
     goto connection_failed;
diff --git a/src/modules/module-protocol-native.c b/src/modules/module-protocol-native.c
index 2fc2e16f6..43aa6aa57 100644
--- a/src/modules/module-protocol-native.c
+++ b/src/modules/module-protocol-native.c
@@ -635,7 +635,7 @@ static int impl_steal_fd(struct pw_protocol_client *client)
 	if (impl->source == NULL)
 		return -EIO;
 
-	fd = dup(impl->source->fd);
+	fd = fcntl(impl->source->fd, F_DUPFD_CLOEXEC, 3);
 	if (fd < 0)
 		return -errno;