diff --git a/sys/src/libauthsrv/readcons.c b/sys/src/libauthsrv/readcons.c
index 8a7a3af27..d9a9ead94 100644
--- a/sys/src/libauthsrv/readcons.c
+++ b/sys/src/libauthsrv/readcons.c
@@ -13,13 +13,13 @@ readcons(char *prompt, char *def, int raw)
 	s = p = nil;
 	fdout = ctl = -1;
 
-	if((fdin = open("/dev/cons", OREAD)) < 0)
+	if((fdin = open("/dev/cons", OREAD|OCEXEC)) < 0)
 		goto Out;
-	if((fdout = open("/dev/cons", OWRITE)) < 0)
+	if((fdout = open("/dev/cons", OWRITE|OCEXEC)) < 0)
 		goto Out;
 
 	if(raw){
-		if((ctl = open("/dev/consctl", OWRITE)) < 0)
+		if((ctl = open("/dev/consctl", OWRITE|OCEXEC)) < 0)
 			goto Out;
 		write(ctl, "rawon", 5);
 	}
diff --git a/sys/src/libauthsrv/readnvram.c b/sys/src/libauthsrv/readnvram.c
index 1a00835cf..e13641bd6 100644
--- a/sys/src/libauthsrv/readnvram.c
+++ b/sys/src/libauthsrv/readnvram.c
@@ -91,9 +91,9 @@ findnvram(Nvrwhere *locp)
 			v[0] = "";
 			v[1] = nil;
 		}
-		fd = open(v[0], ORDWR);
+		fd = open(v[0], ORDWR|OCEXEC);
 		if (fd < 0)
-			fd = open(v[0], OREAD);
+			fd = open(v[0], OREAD|OCEXEC);
 		safelen = sizeof(Nvrsafe);
 		if(strstr(v[0], "/9fat") == nil)
 			safeoff = 0;
@@ -120,7 +120,7 @@ findnvram(Nvrwhere *locp)
 		for(i=0; i<nelem(nvtab); i++){
 			if(strcmp(cputype, nvtab[i].cputype) != 0)
 				continue;
-			if((fd = open(nvtab[i].file, ORDWR)) < 0)
+			if((fd = open(nvtab[i].file, ORDWR|OCEXEC)) < 0)
 				continue;
 			safeoff = nvtab[i].off;
 			safelen = nvtab[i].len;