diff --git a/src/context.c b/src/context.c
index fde95d84..adeb0752 100644
--- a/src/context.c
+++ b/src/context.c
@@ -3085,10 +3085,9 @@ getdns_context_get_upstream_recursive_servers(getdns_context *context,
 		if (upstream->tsig_alg) {
 			tsig_info = _getdns_get_tsig_info(upstream->tsig_alg);
 
-			bindata.data = tsig_info->dname;
-			bindata.size = tsig_info->dname_len;
-			if ((r = getdns_dict_set_bindata(
-			    d, "tsig_algorithm", &bindata)))
+			if ((r = _getdns_dict_set_const_bindata(
+			    d, "tsig_algorithm",
+			    tsig_info->dname_len, tsig_info->dname)))
 				break;
 
 			if (upstream->tsig_dname_len) {
diff --git a/src/dnssec.c b/src/dnssec.c
index 573d0ca5..28455678 100644
--- a/src/dnssec.c
+++ b/src/dnssec.c
@@ -268,7 +268,7 @@ static uint8_t *_dname_label_copy(uint8_t *dst, const uint8_t *src, size_t dst_l
 	return r;
 }
 
-inline void _dname_canonicalize(const uint8_t *src, uint8_t *dst)
+inline static void _dname_canonicalize(const uint8_t *src, uint8_t *dst)
 {
 	const uint8_t *next_label;
 
@@ -280,7 +280,7 @@ inline void _dname_canonicalize(const uint8_t *src, uint8_t *dst)
 	}
 }
 
-inline void _dname_canonicalize2(uint8_t *dname)
+inline static void _dname_canonicalize2(uint8_t *dname)
 {
 	_dname_canonicalize(dname, dname);
 }
diff --git a/src/request-internal.c b/src/request-internal.c
index dbb8a034..d4826f41 100644
--- a/src/request-internal.c
+++ b/src/request-internal.c
@@ -402,13 +402,13 @@ _getdns_network_validate_tsig(getdns_network_req *req)
 {
 	_getdns_rr_iter  rr_spc, *rr;
 	_getdns_rdf_iter rdf_spc, *rdf;
-	uint8_t  *request_mac;
-	uint16_t  request_mac_len;
+	const uint8_t *request_mac;
+	uint16_t       request_mac_len;
 	uint8_t   tsig_vars[MAXIMUM_TSIG_SPACE];
 	gldns_buffer gbuf;
-	uint8_t  *dname;
+	const uint8_t  *dname;
 	size_t    dname_len;
-	uint8_t  *response_mac;
+	const uint8_t  *response_mac;
 	uint16_t  response_mac_len;
 	uint8_t   other_len;
 	uint8_t   result_mac[EVP_MAX_MD_SIZE];
diff --git a/src/stub.c b/src/stub.c
index fb86b96d..4576851e 100644
--- a/src/stub.c
+++ b/src/stub.c
@@ -197,7 +197,7 @@ attach_edns_cookie(getdns_network_req *req)
 /* Will find a matching OPT RR, but leaves the caller to validate it*/
 static int
 match_edns_opt_rr(uint16_t code, uint8_t *response, size_t response_len,
-                  uint8_t **position, uint16_t *option_len)
+                  const uint8_t **position, uint16_t *option_len)
 {
 	_getdns_rr_iter rr_iter_storage, *rr_iter;
 	const uint8_t *pos;
@@ -226,10 +226,10 @@ match_edns_opt_rr(uint16_t code, uint8_t *response, size_t response_len,
 #if defined(STUB_DEBUG) && STUB_DEBUG
 	char str_spc[8192], *str = str_spc;
 	size_t str_len = sizeof(str_spc);
-	uint8_t *data = rr_iter->pos;
+	uint8_t *data = (uint8_t *)rr_iter->pos;
 	size_t data_len = rr_iter->nxt - rr_iter->pos;
 	(void) gldns_wire2str_rr_scan(
-	    &data, &data_len, &str, &str_len, rr_iter->pkt, rr_iter->pkt_end - rr_iter->pkt);
+	    &data, &data_len, &str, &str_len, (uint8_t *)rr_iter->pkt, rr_iter->pkt_end - rr_iter->pkt);
 	DEBUG_STUB("OPT RR: %s", str_spc);
 #endif
 
@@ -262,7 +262,7 @@ static int
 match_and_process_server_cookie(
     getdns_upstream *upstream, uint8_t *response, size_t response_len) 
 {
-	uint8_t *position = NULL;
+	const uint8_t *position = NULL;
 	uint16_t option_len = 0;
 	int found = match_edns_opt_rr(EDNS_COOKIE_OPCODE, response, 
 	                              response_len, &position, &option_len);
@@ -299,7 +299,7 @@ process_keepalive(
     getdns_upstream *upstream, getdns_network_req *netreq, 
     uint8_t *response, size_t response_len) 
 {
-	uint8_t *position = NULL;
+	const uint8_t *position = NULL;
 	uint16_t option_len = 0;
 	int found = match_edns_opt_rr(GLDNS_EDNS_KEEPALIVE, response, 
 	                              response_len, &position, &option_len);