diff --git a/conn.go b/conn.go
index 79b1dba..edd0c55 100644
--- a/conn.go
+++ b/conn.go
@@ -38,9 +38,9 @@ type Conn struct {
 	handle uint32
 }
 
-// Open calls [OpenFlags] with [OPEN_READWRITE], [OPEN_CREATE], [OPEN_URI] and [OPEN_NOFOLLOW].
+// Open calls [OpenFlags] with [OPEN_READWRITE], [OPEN_CREATE] and [OPEN_URI].
 func Open(filename string) (*Conn, error) {
-	return newConn(filename, OPEN_READWRITE|OPEN_CREATE|OPEN_URI|OPEN_NOFOLLOW)
+	return newConn(filename, OPEN_READWRITE|OPEN_CREATE|OPEN_URI)
 }
 
 // OpenFlags opens an SQLite database file as specified by the filename argument.
diff --git a/util/osutil/open_windows.go b/util/osutil/open_windows.go
index 277f58b..417faa5 100644
--- a/util/osutil/open_windows.go
+++ b/util/osutil/open_windows.go
@@ -15,7 +15,7 @@ func OpenFile(name string, flag int, perm fs.FileMode) (*os.File, error) {
 	if name == "" {
 		return nil, &os.PathError{Op: "open", Path: name, Err: ENOENT}
 	}
-	r, e := syscallOpen(name, flag, uint32(perm.Perm()))
+	r, e := syscallOpen(name, flag|O_CLOEXEC, uint32(perm.Perm()))
 	if e != nil {
 		return nil, &os.PathError{Op: "open", Path: name, Err: e}
 	}
diff --git a/vfs/file.go b/vfs/file.go
index 176b250..ebd42e9 100644
--- a/vfs/file.go
+++ b/vfs/file.go
@@ -19,17 +19,18 @@ func (vfsOS) FullPathname(path string) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	fi, err := os.Lstat(path)
+	return path, testSymlinks(filepath.Dir(path))
+}
+
+func testSymlinks(path string) error {
+	p, err := filepath.EvalSymlinks(path)
 	if err != nil {
-		if errors.Is(err, fs.ErrNotExist) {
-			return path, nil
-		}
-		return "", err
+		return err
 	}
-	if fi.Mode()&fs.ModeSymlink != 0 {
-		err = _OK_SYMLINK
+	if p != path {
+		return _OK_SYMLINK
 	}
-	return path, err
+	return nil
 }
 
 func (vfsOS) Delete(path string, syncDir bool) error {
@@ -74,7 +75,7 @@ func (vfsOS) Open(name string, flags OpenFlag) (File, OpenFlag, error) {
 }
 
 func (vfsOS) OpenFilename(name *Filename, flags OpenFlag) (File, OpenFlag, error) {
-	var oflags int
+	oflags := _O_NOFOLLOW
 	if flags&OPEN_EXCLUSIVE != 0 {
 		oflags |= os.O_EXCL
 	}
diff --git a/vfs/os_std_access.go b/vfs/os_std.go
similarity index 73%
rename from vfs/os_std_access.go
rename to vfs/os_std.go
index 1621c09..87ce58b 100644
--- a/vfs/os_std_access.go
+++ b/vfs/os_std.go
@@ -7,6 +7,8 @@ import (
 	"os"
 )
 
+const _O_NOFOLLOW = 0
+
 func osAccess(path string, flags AccessFlag) error {
 	fi, err := os.Stat(path)
 	if err != nil {
@@ -34,3 +36,12 @@ func osAccess(path string, flags AccessFlag) error {
 	}
 	return nil
 }
+
+func osSetMode(file *os.File, modeof string) error {
+	fi, err := os.Stat(modeof)
+	if err != nil {
+		return err
+	}
+	file.Chmod(fi.Mode())
+	return nil
+}
diff --git a/vfs/os_std_mode.go b/vfs/os_std_mode.go
deleted file mode 100644
index ac49047..0000000
--- a/vfs/os_std_mode.go
+++ /dev/null
@@ -1,14 +0,0 @@
-//go:build !unix || sqlite3_nosys
-
-package vfs
-
-import "os"
-
-func osSetMode(file *os.File, modeof string) error {
-	fi, err := os.Stat(modeof)
-	if err != nil {
-		return err
-	}
-	file.Chmod(fi.Mode())
-	return nil
-}
diff --git a/vfs/os_unix.go b/vfs/os_unix.go
index 111af79..7a54088 100644
--- a/vfs/os_unix.go
+++ b/vfs/os_unix.go
@@ -9,6 +9,8 @@ import (
 	"golang.org/x/sys/unix"
 )
 
+const _O_NOFOLLOW = unix.O_NOFOLLOW
+
 func osAccess(path string, flags AccessFlag) error {
 	var access uint32 // unix.F_OK
 	switch flags {