diff --git a/NOFORK_NOEXEC.lst b/NOFORK_NOEXEC.lst
index 97b7d8b20..dc2828069 100644
--- a/NOFORK_NOEXEC.lst
+++ b/NOFORK_NOEXEC.lst
@@ -53,7 +53,7 @@ blkdiscard
 blkid
 blockdev - noexec. leaks fd
 bootchartd - daemon
-brctl
+brctl - noexec
 bunzip2 - runner
 busybox
 bzcat - runner
diff --git a/networking/brctl.c b/networking/brctl.c
index 690791e4c..5d5f0af30 100644
--- a/networking/brctl.c
+++ b/networking/brctl.c
@@ -39,7 +39,7 @@
 //config:	Add support for option which prints the current config:
 //config:		show
 
-//applet:IF_BRCTL(APPLET(brctl, BB_DIR_USR_SBIN, BB_SUID_DROP))
+//applet:IF_BRCTL(APPLET_NOEXEC(brctl, brctl, BB_DIR_USR_SBIN, BB_SUID_DROP, brctl))
 
 //kbuild:lib-$(CONFIG_BRCTL) += brctl.o