diff --git a/src/pulsecore/memfd-wrappers.h b/src/pulsecore/memfd-wrappers.h
index c7aadfd3c..4708751ad 100644
--- a/src/pulsecore/memfd-wrappers.h
+++ b/src/pulsecore/memfd-wrappers.h
@@ -66,4 +66,8 @@ static inline int memfd_create(const char *name, unsigned int flags) {
 
 #endif /* HAVE_MEMFD && !HAVE_MEMFD_CREATE */
 
+#ifndef MFD_NOEXEC_SEAL
+#define MFD_NOEXEC_SEAL   0x0008U
+#endif
+
 #endif
diff --git a/src/pulsecore/shm.c b/src/pulsecore/shm.c
index ff54dcb59..4247b0921 100644
--- a/src/pulsecore/shm.c
+++ b/src/pulsecore/shm.c
@@ -164,7 +164,7 @@ static int sharedmem_create(pa_shm *m, pa_mem_type_t type, size_t size, mode_t m
 #endif
 #ifdef HAVE_MEMFD
     case PA_MEM_TYPE_SHARED_MEMFD:
-        fd = memfd_create("pulseaudio", MFD_ALLOW_SEALING|MFD_CLOEXEC);
+        fd = memfd_create("pulseaudio", MFD_ALLOW_SEALING|MFD_CLOEXEC|MFD_NOEXEC_SEAL);
         break;
 #endif
     default: