diff --git a/redox-rt/src/sys.rs b/redox-rt/src/sys.rs
index a536e73c98..acabed309b 100644
--- a/redox-rt/src/sys.rs
+++ b/redox-rt/src/sys.rs
@@ -974,7 +974,7 @@ impl FdTbl {
         // creation"). A plain lseek did not force the underlying scheme to
         // re-materialize the current descriptor set.
         let buf = b"refresh";
-        unsafe {
+        let refreshed = unsafe {
             syscall::syscall4(
                 syscall::SYS_DUP2,
                 files_reader_fd,
@@ -982,7 +982,14 @@ impl FdTbl {
                 buf.as_ptr() as usize,
                 buf.len(),
             )
-        }?;
+        };
+        // If the kernel cannot refresh this filetable here (e.g. permission or
+        // context constraints for a uid-dropped / namespace-restricted exec),
+        // fall back to the plain lseek so process startup still succeeds —
+        // NON-FATAL so we never break spawn while the refresh path is stabilized.
+        if refreshed.is_err() {
+            let _ = filetable_fd.lseek(0, syscall::flag::SEEK_SET);
+        }
 
         fdtbl.resize(Self::DEFAULT_CAPACITY);