diff --git a/usr.sbin/rtsold/rtsold.c b/usr.sbin/rtsold/rtsold.c
--- a/usr.sbin/rtsold/rtsold.c
+++ b/usr.sbin/rtsold/rtsold.c
@@ -221,6 +221,17 @@
 			errx(1, "failed to daemonize");
 	}
 
+#ifdef WITH_CASPER
+	/*
+	 * The casper daemon forked by cap_init() using pdfork(2) is killed
+	 * with SIGKILL by the kernel when we close its process descriptor, and
+	 * would otherwise linger as a zombie for the lifetime of this process.
+	 * Scripts are run by the rtsold.script service, so ignoring
+	 * SIGCHLD does not interfere with script handling.
+	 */
+	(void)signal(SIGCHLD, SIG_IGN);
+#endif
+
 	if ((error = init_capabilities()) != 0)
 		err(1, "failed to initialize capabilities");