diff --git a/NOFORK_NOEXEC.lst b/NOFORK_NOEXEC.lst
index 5ec9ae3fe..ad49cd809 100644
--- a/NOFORK_NOEXEC.lst
+++ b/NOFORK_NOEXEC.lst
@@ -244,7 +244,7 @@ nameif - leaks: config_open2+ioctl_or_perror_and_die
 nbd-client
 nc - runner
 netstat - runner with -c
-nice - noexec candidate, spawner
+nice - noexec. spawner
 nl - runner
 nmeter - longterm
 nohup - noexec. spawner
@@ -284,7 +284,7 @@ reboot - rare
 reformime - runner
 remove-shell
 renice - nofork candidate(uses getpwnam, is that ok?)
-reset - noexec candidate, spawner (execs "stty")
+reset - noexec. spawner (execs "stty")
 resize - noexec. changes state (signal handlers)
 rev - runner
 rm - noexec. rm -i interactive
@@ -330,7 +330,7 @@ ssl_client - longterm
 start-stop-daemon
 stat - nofork candidate(needs fewer allocs)
 strings - runner
-stty - noexec/nofork candidate. has no allocs or opens except xmove_fd(xopen("-F DEVICE"),STDIN). tcsetattr(STDIN) is not a problem: it would work the same across processes sharing this fd
+stty - noexec. nofork candidate: has no allocs or opens except xmove_fd(xopen("-F DEVICE"),STDIN). tcsetattr(STDIN) is not a problem: it would work the same across processes sharing this fd
 su - suid, spawner
 sulogin - noexec. spawner
 sum - runner
diff --git a/coreutils/stty.c b/coreutils/stty.c
index f987fbbcf..d09f0e453 100644
--- a/coreutils/stty.c
+++ b/coreutils/stty.c
@@ -25,7 +25,7 @@
 //config:	help
 //config:	stty is used to change and print terminal line settings.
 
-//applet:IF_STTY(APPLET(stty, BB_DIR_BIN, BB_SUID_DROP))
+//applet:IF_STTY(APPLET_NOEXEC(stty, stty, BB_DIR_BIN, BB_SUID_DROP, stty))
 
 //kbuild:lib-$(CONFIG_STTY) += stty.o