diff --git a/tools/libinput-debug-gui.c b/tools/libinput-debug-gui.c
index af41682c..2344925a 100644
--- a/tools/libinput-debug-gui.c
+++ b/tools/libinput-debug-gui.c
@@ -1335,7 +1335,7 @@ register_evdev_device(struct window *w, struct libinput_device *dev)
 	ud = libinput_device_get_udev_device(dev);
 	device_node = udev_device_get_devnode(ud);
 
-	fd = open(device_node, O_RDONLY | O_NONBLOCK);
+	fd = open(device_node, O_RDONLY | O_NONBLOCK | O_CLOEXEC);
 	if (fd == -1) {
 		msg("failed to open %s, evdev events unavailable\n", device_node);
 		goto out;
diff --git a/tools/libinput-debug-tablet-pad.c b/tools/libinput-debug-tablet-pad.c
index 92a6bb13..d14d9edb 100644
--- a/tools/libinput-debug-tablet-pad.c
+++ b/tools/libinput-debug-tablet-pad.c
@@ -258,7 +258,7 @@ handle_device_added(struct context *ctx, struct libinput_event *ev)
 
 	devnode = udev_device_get_devnode(udev_device);
 	if (devnode) {
-		int fd = open(devnode, O_RDONLY | O_NONBLOCK);
+		int fd = open(devnode, O_RDONLY | O_NONBLOCK | O_CLOEXEC);
 		if (fd == -1)
 			return;
 		if (libevdev_new_from_fd(fd, &ctx->evdev) != 0) {
diff --git a/tools/libinput-debug-tablet.c b/tools/libinput-debug-tablet.c
index bc8d24f0..2848dc64 100644
--- a/tools/libinput-debug-tablet.c
+++ b/tools/libinput-debug-tablet.c
@@ -276,7 +276,7 @@ handle_device_added(struct context *ctx, struct libinput_event *ev)
 
 	devnode = udev_device_get_devnode(udev_device);
 	if (devnode) {
-		int fd = open(devnode, O_RDONLY | O_NONBLOCK);
+		int fd = open(devnode, O_RDONLY | O_NONBLOCK | O_CLOEXEC);
 		assert(fd != -1);
 		assert(libevdev_new_from_fd(fd, &ctx->evdev) == 0);
 		ctx->fds[1].fd = fd;
diff --git a/tools/libinput-record.c b/tools/libinput-record.c
index 1cff07e8..a06b9c3f 100644
--- a/tools/libinput-record.c
+++ b/tools/libinput-record.c
@@ -1695,7 +1695,7 @@ print_hid_report_descriptor(struct record_device *dev)
 	if (len <= 0)
 		return;
 
-	fd = open(syspath, O_RDONLY);
+	fd = open(syspath, O_RDONLY | O_CLOEXEC);
 	if (fd == -1)
 		return;
 
@@ -1926,7 +1926,7 @@ select_device(void)
 		char path[PATH_MAX];
 
 		snprintf(path, sizeof(path), "/dev/input/%s", entry->d_name);
-		_cleanup_(xclose) int fd = open(path, O_RDONLY);
+		_cleanup_(xclose) int fd = open(path, O_RDONLY | O_CLOEXEC);
 		if (fd < 0) {
 			if (errno == EACCES)
 				has_eaccess = true;
@@ -2395,7 +2395,7 @@ init_device(struct record_context *ctx, const char *path, bool grab)
 
 	list_init(&d->hidraw_devices);
 
-	_cleanup_(xclose) int fd = open(d->devnode, O_RDONLY | O_NONBLOCK);
+	_cleanup_(xclose) int fd = open(d->devnode, O_RDONLY | O_NONBLOCK | O_CLOEXEC);
 	if (fd < 0) {
 		fprintf(stderr, "Failed to open device %s (%m)\n", d->devnode);
 		return false;
@@ -2514,7 +2514,7 @@ init_hidraw(struct record_context *ctx)
 				 sizeof(hidraw_node),
 				 "/dev/%s",
 				 entry->d_name);
-			fd = open(hidraw_node, O_RDONLY | O_NONBLOCK);
+			fd = open(hidraw_node, O_RDONLY | O_NONBLOCK | O_CLOEXEC);
 			if (fd == -1)
 				continue;