diff --git a/Lib/tempfile.py b/Lib/tempfile.py
index 90b3c20..0aaee54 100644
--- a/Lib/tempfile.py
+++ b/Lib/tempfile.py
@@ -57,6 +57,8 @@
 _allocate_lock = _thread.allocate_lock
 
 _text_openflags = _os.O_RDWR | _os.O_CREAT | _os.O_EXCL
+if hasattr(_os, 'O_CLOEXEC'):
+    _text_openflags |= _os.O_CLOEXEC
 if hasattr(_os, 'O_NOINHERIT'):
     _text_openflags |= _os.O_NOINHERIT
 if hasattr(_os, 'O_NOFOLLOW'):
diff --git a/Misc/NEWS b/Misc/NEWS
index e638039..284ce1a 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -204,6 +204,9 @@
 Library
 -------
 
+- Issue #16860: In tempfile, use O_CLOEXEC when available to set the
+  close-on-exec flag atomically.
+
 - Issue #16674: random.getrandbits() is now 20-40% faster for small integers.
 
 - Issue #16009: JSON error messages now provide more information.