diff --git a/slock.c b/slock.c
index c9cdee2..7f17ed3 100644
--- a/slock.c
+++ b/slock.c
@@ -299,6 +299,12 @@ main(int argc, char **argv) {
 	dontkillme();
 #endif
 
+#if defined(__OpenBSD__)
+	if (pledge("stdio dns unix rpath prot_exec getpw proc exec", NULL) < 0) {
+		die("pledge\n");
+	}
+#endif
+
 	if (!getpwuid(getuid()))
 		die("no passwd entry for you\n");
 
@@ -334,6 +340,12 @@ main(int argc, char **argv) {
 		die("execvp %s failed: %s\n", argv[1], strerror(errno));
 	}
 
+#if defined(__OpenBSD__)
+	if (pledge("stdio rpath getpw proc exec", NULL) < 0) {
+		die("pledge\n");
+	}
+#endif
+
 	/* Everything is now blank. Now wait for the correct password. */
 #ifdef HAVE_BSD_AUTH
 	readpw(dpy);