diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fcaf3b6..db93030 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,7 +34,7 @@ jobs:
           path: src/github.com/containerd/go-runc
           fetch-depth: 25
 
-      - uses: containerd/project-checks@v1.1.0
+      - uses: containerd/project-checks@d7751f3c375b8fe4a84c02a068184ee4c1f59bc4 # v1.2.2
         with:
           working-directory: src/github.com/containerd/go-runc
 
diff --git a/command_linux.go b/command_linux.go
index 8a30f67..5331b08 100644
--- a/command_linux.go
+++ b/command_linux.go
@@ -25,11 +25,15 @@ import (
 )
 
 func (r *Runc) command(context context.Context, args ...string) *exec.Cmd {
+	return r.commandWithCustomLogFile(context, "", args...)
+}
+
+func (r *Runc) commandWithCustomLogFile(context context.Context, logFile string, args ...string) *exec.Cmd {
 	command := r.Command
 	if command == "" {
 		command = DefaultCommand
 	}
-	cmd := exec.CommandContext(context, command, append(r.args(), args...)...)
+	cmd := exec.CommandContext(context, command, append(r.args(logFile), args...)...)
 	cmd.SysProcAttr = &syscall.SysProcAttr{
 		Setpgid: r.Setpgid,
 	}
diff --git a/command_other.go b/command_other.go
index a4adbe1..3ba1c87 100644
--- a/command_other.go
+++ b/command_other.go
@@ -25,11 +25,15 @@ import (
 )
 
 func (r *Runc) command(context context.Context, args ...string) *exec.Cmd {
+	return r.commandWithCustomLogFile(context, "", args...)
+}
+
+func (r *Runc) commandWithCustomLogFile(context context.Context, logFile string, args ...string) *exec.Cmd {
 	command := r.Command
 	if command == "" {
 		command = DefaultCommand
 	}
-	cmd := exec.CommandContext(context, command, append(r.args(), args...)...)
+	cmd := exec.CommandContext(context, command, append(r.args(logFile), args...)...)
 	cmd.Env = os.Environ()
 	return cmd
 }
diff --git a/runc.go b/runc.go
index 61646df..c2328fb 100644
--- a/runc.go
+++ b/runc.go
@@ -228,6 +228,7 @@ func (r *Runc) Start(context context.Context, id string) error {
 // ExecOpts holds optional settings when starting an exec process with runc
 type ExecOpts struct {
 	IO
+	LogFile       string
 	PidFile       string
 	ConsoleSocket ConsoleSocket
 	Detach        bool
@@ -280,7 +281,7 @@ func (r *Runc) Exec(context context.Context, id string, spec specs.Process, opts
 		return err
 	}
 	args = append(args, oargs...)
-	cmd := r.command(context, append(args, id)...)
+	cmd := r.commandWithCustomLogFile(context, opts.LogFile, append(args, id)...)
 	if opts.IO != nil {
 		opts.Set(cmd)
 	}
@@ -765,7 +766,7 @@ func (r *Runc) Features(context context.Context) (*features.Features, error) {
 	return &feat, nil
 }
 
-func (r *Runc) args() (out []string) {
+func (r *Runc) args(logFile string) (out []string) {
 	if r.Root != "" {
 		out = append(out, "--root", r.Root)
 	}
@@ -773,7 +774,12 @@ func (r *Runc) args() (out []string) {
 		out = append(out, "--debug")
 	}
 	if r.Log != "" {
-		out = append(out, "--log", r.Log)
+		if logFile == "" {
+			out = append(out, "--log", r.Log)
+		}
+	}
+	if logFile != "" {
+		out = append(out, "--log", logFile)
 	}
 	if r.LogFormat != none {
 		out = append(out, "--log-format", string(r.LogFormat))
diff --git a/runc_test.go b/runc_test.go
index 610cffd..8df2034 100644
--- a/runc_test.go
+++ b/runc_test.go
@@ -21,6 +21,7 @@ import (
 	"errors"
 	"os"
 	"os/exec"
+	"strings"
 	"sync"
 	"syscall"
 	"testing"
@@ -336,6 +337,33 @@ func TestCreateArgs(t *testing.T) {
 	}
 }
 
+func TestExecWithLogFile(t *testing.T) {
+	ctx := context.Background()
+	o := &Runc{}
+	cmd := o.commandWithCustomLogFile(ctx, "/tmp/exec.log", "version")
+	if got := strings.Join(cmd.Args[1:], " "); got != "--log /tmp/exec.log version" {
+		t.Fatalf("expected args %q, got %q", "--log /tmp/exec.log version", got)
+	}
+
+	o = &Runc{Log: "/tmp/runc.log"}
+	cmd = o.commandWithCustomLogFile(ctx, "/tmp/exec.log", "version")
+	if got := strings.Join(cmd.Args[1:], " "); got != "--log /tmp/exec.log version" {
+		t.Fatalf("expected args %q, got %q", "--log /tmp/exec.log version", got)
+	}
+
+	o = &Runc{Log: "/tmp/runc.log"}
+	cmd = o.commandWithCustomLogFile(ctx, "", "version")
+	if got := strings.Join(cmd.Args[1:], " "); got != "--log /tmp/runc.log version" {
+		t.Fatalf("expected args %q, got %q", "--log /tmp/runc.log version", got)
+	}
+
+	o = &Runc{}
+	cmd = o.commandWithCustomLogFile(ctx, "", "version")
+	if got := strings.Join(cmd.Args[1:], " "); got != "version" {
+		t.Fatalf("expected args %q, got %q", "version", got)
+	}
+}
+
 func TestRuncFeatures(t *testing.T) {
 	ctx := context.Background()
 	if _, err := exec.LookPath(DefaultCommand); err != nil {