diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,5 +1,10 @@
 # ChangeLog
 
+## 3.3.6
+
+* Setting FD_CLOEXEC on the listening socket.
+  [#923](https://github.com/yesodweb/wai/pull/923)
+
 ## 3.3.5
 
 * Switching the version of the "recv" package from 0.0.x to 0.1.x.
diff --git a/Network/Wai/Handler/WarpTLS.hs b/Network/Wai/Handler/WarpTLS.hs
--- a/Network/Wai/Handler/WarpTLS.hs
+++ b/Network/Wai/Handler/WarpTLS.hs
@@ -197,7 +197,9 @@
     bracket
         (bindPortTCP (getPort set) (getHost set))
         close
-        (\sock -> runTLSSocket tset set sock app)
+        (\sock -> do
+            setSocketCloseOnExec sock
+            runTLSSocket tset set sock app)
 
 ----------------------------------------------------------------
 
diff --git a/warp-tls.cabal b/warp-tls.cabal
--- a/warp-tls.cabal
+++ b/warp-tls.cabal
@@ -1,5 +1,5 @@
 Name:                warp-tls
-Version:             3.3.5
+Version:             3.3.6
 Synopsis:            HTTP over TLS support for Warp via the TLS package
 License:             MIT
 License-file:        LICENSE