diff --git a/src/portable/portable.c b/src/portable/portable.c
index 325cb702c5..d91ce7bc71 100644
--- a/src/portable/portable.c
+++ b/src/portable/portable.c
@@ -611,7 +611,7 @@ static int extract_image_and_extensions(
                         continue;
 
                 /* We need to keep the fd valid, to return the PortableMetadata to the caller. */
-                extension_release_fd = fd_reopen(extension_release_meta->fd, O_CLOEXEC);
+                extension_release_fd = fd_reopen(extension_release_meta->fd, O_CLOEXEC|O_RDONLY);
                 if (extension_release_fd < 0)
                         return extension_release_fd;