diff --git a/libcontainer/setns_init_linux.go b/libcontainer/setns_init_linux.go
index 7f7c07717..989e5ae23 100644
--- a/libcontainer/setns_init_linux.go
+++ b/libcontainer/setns_init_linux.go
@@ -38,7 +38,6 @@ func (l *linuxSetnsInit) Init() error {
 			if err := selinux.SetKeyLabel(l.config.ProcessLabel); err != nil {
 				return err
 			}
-			defer selinux.SetKeyLabel("") //nolint: errcheck
 		}
 		// Do not inherit the parent's session keyring.
 		if _, err := keys.JoinSessionKeyring(l.getSessionRingName()); err != nil {
@@ -102,7 +101,6 @@ func (l *linuxSetnsInit) Init() error {
 		if err := selinux.SetExecLabel(l.config.ProcessLabel); err != nil {
 			return err
 		}
-		defer selinux.SetExecLabel("") //nolint: errcheck
 	}
 	// Without NoNewPrivileges seccomp is a privileged operation, so we need to
 	// do this before dropping capabilities; otherwise do it as late as possible
diff --git a/libcontainer/standard_init_linux.go b/libcontainer/standard_init_linux.go
index 933c1de34..33062f778 100644
--- a/libcontainer/standard_init_linux.go
+++ b/libcontainer/standard_init_linux.go
@@ -54,7 +54,6 @@ func (l *linuxStandardInit) Init() error {
 			if err := selinux.SetKeyLabel(l.config.ProcessLabel); err != nil {
 				return err
 			}
-			defer selinux.SetKeyLabel("") //nolint: errcheck
 		}
 		ringname, keepperms, newperms := l.getSessionRingParams()
 
@@ -185,7 +184,6 @@ func (l *linuxStandardInit) Init() error {
 		if err := selinux.SetExecLabel(l.config.ProcessLabel); err != nil {
 			return fmt.Errorf("can't set process label: %w", err)
 		}
-		defer selinux.SetExecLabel("") //nolint: errcheck
 	}
 	// Without NoNewPrivileges seccomp is a privileged operation, so we need to
 	// do this before dropping capabilities; otherwise do it as late as possible
diff --git a/tests/integration/selinux.bats b/tests/integration/selinux.bats
index 66665c450..848c74ddb 100644
--- a/tests/integration/selinux.bats
+++ b/tests/integration/selinux.bats
@@ -104,3 +104,20 @@ function enable_userns() {
 	enable_userns
 	exec_check_label
 }
+
+# Check that an execve failure is reported as such, rather than aborting
+# runc init. See https://github.com/opencontainers/runc/issues/5438.
+@test "runc run (execve error + custom selinux label)" {
+	cat <<-EOF >rootfs/run.sh
+		#!/mmnnttbb foo bar
+		sh
+	EOF
+	chmod +x rootfs/run.sh
+
+	update_config '	  .process.selinuxLabel |= "system_u:system_r:container_t:s0:c4,c5"
+			| .process.args = ["/run.sh"]'
+	runc run tst
+	[ "$status" -ne 0 ]
+	[ ${#lines[@]} -eq 1 ]
+	[[ "${lines[0]}" = "exec /run.sh: no such file or directory" ]]
+}