diff --git a/bin/df/df.c b/bin/df/df.c
index e07df3270356..3ed7c1e8f49c 100644
--- a/bin/df/df.c
+++ b/bin/df/df.c
@@ -251,7 +251,7 @@ main(int argc, char *argv[])
 					free(mntpath);
 					continue;
 				}
-				if (mount(fstype, mntpt, MNT_RDONLY,
+				if (mount(fstype, mntpt, MNT_RDONLY|MNT_NOEXEC,
 				    &mdev) != 0) {
 					xo_warn("%s", *argv);
 					rv = 1;