diff --git a/NOFORK_NOEXEC.lst b/NOFORK_NOEXEC.lst
index 6595b9d2f..8580593cb 100644
--- a/NOFORK_NOEXEC.lst
+++ b/NOFORK_NOEXEC.lst
@@ -92,8 +92,8 @@ deallocvt - noexec. leaks: get_console_fd_or_die() may open a new fd, or return
 delgroup - noexec. leaks
 deluser - noexec. leaks
 depmod - longterm(ish)
-devmem - runner, complex (access to device memory may hang)
-df - leaks: nested allocs
+devmem - hardware (access to device memory may hang)
+df - noexec. leaks: nested allocs
 dhcprelay - daemon
 diff - runner
 dirname - NOFORK
diff --git a/coreutils/df.c b/coreutils/df.c
index 27dd2b5a8..4d6534bc2 100644
--- a/coreutils/df.c
+++ b/coreutils/df.c
@@ -33,7 +33,7 @@
 //config:	-i Inodes
 //config:	-B <SIZE> Blocksize
 
-//applet:IF_DF(APPLET(df, BB_DIR_BIN, BB_SUID_DROP))
+//applet:IF_DF(APPLET_NOEXEC(df, df, BB_DIR_BIN, BB_SUID_DROP, df))
 
 //kbuild:lib-$(CONFIG_DF) += df.o