diff --git a/src/xzdec/xzdec.c b/src/xzdec/xzdec.c
index 88866da7..d281e071 100644
--- a/src/xzdec/xzdec.c
+++ b/src/xzdec/xzdec.c
@@ -362,6 +362,8 @@ sandbox_enter(int src_fd)
 		// before activating the sandbox.
 		if (syscall(SYS_landlock_restrict_self, ruleset_fd, 0U) != 0)
 			goto error;
+
+		(void)close(ruleset_fd);
 	}
 
 	(void)src_fd;