diff --git a/src/lib.rs b/src/lib.rs
index f572039..d8990c3 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -58,7 +58,7 @@ pub struct NotifyToken {
 }
 
 pub fn notify_pair() -> rustix::io::Result<(Notify, NotifyToken)> {
-    let (registered, free) = rustix::io::pipe_with(PipeFlags::NONBLOCK)?;
+    let (registered, free) = rustix::io::pipe_with(PipeFlags::NONBLOCK | PipeFlags::CLOEXEC)?;
 
     Ok((
         Notify { registered },
diff --git a/src/net.rs b/src/net.rs
index 14da0c7..31c726b 100644
--- a/src/net.rs
+++ b/src/net.rs
@@ -27,7 +27,10 @@ pub struct TcpListenerBuilder {
 
 impl TcpListener {
     pub fn try_accept(&self) -> rustix::io::Result<Option<(TcpStream, SocketAddrAny)>> {
-        match rustix::net::acceptfrom_with(&self.inner, AcceptFlags::NONBLOCK) {
+        match rustix::net::acceptfrom_with(
+            &self.inner,
+            AcceptFlags::NONBLOCK | AcceptFlags::CLOEXEC,
+        ) {
             Ok((inner, addr)) => Ok(Some((TcpStream { inner }, addr))),
             Err(e) if e == rustix::io::Error::WOULDBLOCK || e == rustix::io::Error::AGAIN => {
                 Ok(None)
@@ -37,21 +40,18 @@ impl TcpListener {
     }
 
     pub fn bind(ip: IpAddr, port: u16) -> rustix::io::Result<TcpListenerBuilder> {
-        let sock = match ip {
-            IpAddr::V4(_) => rustix::net::socket_with(
-                AddressFamily::INET,
-                SocketType::STREAM,
-                SocketFlags::NONBLOCK,
-                Protocol::TCP,
-            )?,
-            IpAddr::V6(_) => rustix::net::socket_with(
-                AddressFamily::INET6,
-                SocketType::STREAM,
-                SocketFlags::NONBLOCK,
-                Protocol::TCP,
-            )?,
+        let family = match ip {
+            IpAddr::V4(_) => AddressFamily::INET,
+            IpAddr::V6(_) => AddressFamily::INET6,
         };
 
+        let sock = rustix::net::socket_with(
+            family,
+            SocketType::STREAM,
+            SocketFlags::NONBLOCK | SocketFlags::CLOEXEC,
+            Protocol::TCP,
+        )?;
+
         rustix::net::sockopt::set_socket_reuseaddr(&sock, true)?;
 
         Ok(TcpListenerBuilder {
@@ -64,21 +64,18 @@ impl TcpListener {
 
 impl TcpStream {
     pub fn connect(ip: IpAddr, port: u16) -> rustix::io::Result<TcpStreamBuilder> {
-        let sock = match ip {
-            IpAddr::V4(_) => rustix::net::socket_with(
-                AddressFamily::INET,
-                SocketType::STREAM,
-                SocketFlags::NONBLOCK,
-                Protocol::TCP,
-            )?,
-            IpAddr::V6(_) => rustix::net::socket_with(
-                AddressFamily::INET6,
-                SocketType::STREAM,
-                SocketFlags::NONBLOCK,
-                Protocol::TCP,
-            )?,
+        let family = match ip {
+            IpAddr::V4(_) => AddressFamily::INET,
+            IpAddr::V6(_) => AddressFamily::INET6,
         };
 
+        let sock = rustix::net::socket_with(
+            family,
+            SocketType::STREAM,
+            SocketFlags::NONBLOCK | SocketFlags::CLOEXEC,
+            Protocol::TCP,
+        )?;
+
         Ok(TcpStreamBuilder {
             ip,
             port,