diff --git a/debian/changelog b/debian/changelog
index cb5b36e..8c8e0b6 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,6 +1,7 @@
 cm4all-qrelay (0.26) unstable; urgency=low
 
   * lua: remove deprecated method "mail:get_cgroup()"
+  * lua: close Lua file descriptors when connection is closed
 
  --   
 
diff --git a/libcommon b/libcommon
index 63bd1f8..0d94305 160000
--- a/libcommon
+++ b/libcommon
@@ -1 +1 @@
-Subproject commit 63bd1f83172d313a80df75fabb5780e01b65d384
+Subproject commit 0d943059a7b9ef146639d66c439bcefd0e610177
diff --git a/src/Connection.cxx b/src/Connection.cxx
index 66531d8..55a1e8f 100644
--- a/src/Connection.cxx
+++ b/src/Connection.cxx
@@ -47,6 +47,7 @@ QmqpRelayConnection::QmqpRelayConnection(size_t max_size,
 	 peer_cred(GetSocket().GetPeerCredentials()),
 	 handler(std::move(_handler)),
 	 logger(parent_logger, MakeLoggerDomain(peer_cred, address).c_str()),
+	 auto_close(handler->GetState()),
 	 thread(handler->GetState()),
 	 connect(event_loop, *this),
 	 client(event_loop, 256, *this) {}
@@ -78,7 +79,8 @@ QmqpRelayConnection::OnRequest(AllocatedArray<std::byte> &&payload)
 
 	handler->Push(L);
 
-	NewLuaMail(L, GetMainState(), std::move(mail), peer_cred);
+	NewLuaMail(L, GetMainState(), auto_close,
+		   std::move(mail), peer_cred);
 
 	Resume(L, 1);
 }
diff --git a/src/Connection.hxx b/src/Connection.hxx
index 208d647..5b2c23e 100644
--- a/src/Connection.hxx
+++ b/src/Connection.hxx
@@ -10,6 +10,7 @@
 #include "event/net/djb/NetstringServer.hxx"
 #include "event/net/djb/NetstringClient.hxx"
 #include "net/djb/NetstringGenerator.hxx"
+#include "lua/AutoCloseList.hxx"
 #include "lua/Ref.hxx"
 #include "lua/Resume.hxx"
 #include "lua/ValuePtr.hxx"
@@ -32,6 +33,8 @@ class QmqpRelayConnection final :
 	const Lua::ValuePtr handler;
 	ChildLogger logger;
 
+	Lua::AutoCloseList auto_close;
+
 	NetstringGenerator generator;
 	NetstringHeader sender_header;
 
diff --git a/src/LMail.cxx b/src/LMail.cxx
index 3e30442..36c3e4d 100644
--- a/src/LMail.cxx
+++ b/src/LMail.cxx
@@ -6,6 +6,7 @@
 #include "MutableMail.hxx"
 #include "LAction.hxx"
 #include "Action.hxx"
+#include "lua/AutoCloseList.hxx"
 #include "lua/Class.hxx"
 #include "lua/Error.hxx"
 #include "lua/FenvCache.hxx"
@@ -29,11 +30,15 @@ extern "C" {
 #include <string.h>
 
 class IncomingMail : public MutableMail {
+	Lua::AutoCloseList *auto_close;
+
 	const struct ucred cred;
 
 public:
-	IncomingMail(lua_State *L, MutableMail &&src, const struct ucred &_peer_cred)
+	IncomingMail(lua_State *L, Lua::AutoCloseList &_auto_close,
+		     MutableMail &&src, const struct ucred &_peer_cred)
 		:MutableMail(std::move(src)),
+		 auto_close(&_auto_close),
 		 cred(_peer_cred)
 	{
 		lua_newtable(L);
@@ -313,6 +318,9 @@ IncomingMail::Index(lua_State *L)
 			Lua::RaiseCurrent(L);
 		}
 
+		// auto-close the file descriptor when the connection is closed
+		auto_close->Add(L, Lua::RelativeStackIndex{-1});
+
 		// copy a reference to the fenv (our cache)
 		Lua::SetFenvCache(L, 1, name, Lua::RelativeStackIndex{-1});
 
@@ -352,9 +360,10 @@ RegisterLuaMail(lua_State *L)
 
 MutableMail *
 NewLuaMail(lua_State *L, lua_State *main_L,
+	   Lua::AutoCloseList &auto_close,
 	   MutableMail &&src, const struct ucred &peer_cred)
 {
-	return LuaMail::New(L, main_L, std::move(src), peer_cred);
+	return LuaMail::New(L, main_L, auto_close, std::move(src), peer_cred);
 }
 
 MutableMail &
diff --git a/src/LMail.hxx b/src/LMail.hxx
index a09193a..7b0afeb 100644
--- a/src/LMail.hxx
+++ b/src/LMail.hxx
@@ -8,6 +8,7 @@
 struct ucred;
 struct lua_State;
 struct MutableMail;
+namespace Lua { class AutoCloseList; }
 
 void
 RegisterLuaMail(lua_State *L);
@@ -19,6 +20,7 @@ RegisterLuaMail(lua_State *L);
  */
 MutableMail *
 NewLuaMail(lua_State *L, lua_State *main_L,
+	   Lua::AutoCloseList &auto_close,
 	   MutableMail &&src, const struct ucred &peer_cred);
 
 MutableMail &