diff --git a/fcgi.c b/fcgi.c
index 6fbb21b..6e67ea7 100644
--- a/fcgi.c
+++ b/fcgi.c
@@ -171,7 +171,7 @@ fcgi_send_param(struct bufferevent *bev, const char *name,
 	uint32_t		namlen, vallen, padlen;
 	uint8_t			s[8];
 	size_t			size;
-	char			padding[8] = { 0 };
+	const char		padding[8] = { 0 };
 
 	namlen = strlen(name);
 	vallen = strlen(value);
diff --git a/gmid.c b/gmid.c
index b2aa170..34132bc 100644
--- a/gmid.c
+++ b/gmid.c
@@ -29,7 +29,7 @@
 
 static const char	*opts = "6c:D:d:fH:hnP:p:Vvx:";
 
-static struct option longopts[] = {
+static const struct option longopts[] = {
 	{"help",	no_argument,		NULL,	'h'},
 	{"version",	no_argument,		NULL,	'V'},
 	{NULL,		0,			NULL,	0},
diff --git a/have/landlock.c b/have/landlock.c
index 8be29bd..1e788a6 100644
--- a/have/landlock.c
+++ b/have/landlock.c
@@ -20,7 +20,7 @@ int
 main(void)
 {
 	int rfd;
-	struct landlock_ruleset_attr rsattr = {
+	const struct landlock_ruleset_attr rsattr = {
 		.handled_access_fs =	LANDLOCK_ACCESS_FS_READ_FILE |
 					LANDLOCK_ACCESS_FS_READ_DIR
 	};
diff --git a/mime.c b/mime.c
index cd759de..398d561 100644
--- a/mime.c
+++ b/mime.c
@@ -55,7 +55,7 @@ add_mime(struct mime *mime, const char *mt, const char *ext)
 void
 load_default_mime(struct mime *mime)
 {
-	struct etm *i, m[] = {
+	const struct etm *i, m[] = {
 		{"application/pdf",	"pdf"},
 		{"image/gif",		"gif"},
 		{"image/jpeg",		"jpg"},
diff --git a/parse.y b/parse.y
index 47fd2c6..a71291a 100644
--- a/parse.y
+++ b/parse.y
@@ -500,7 +500,7 @@ optsemicolon	: ';'
 
 %%
 
-static struct keyword {
+static const struct keyword {
 	const char *word;
 	int token;
 } keywords[] = {
diff --git a/proxy.c b/proxy.c
index 1a30531..c4f0677 100644
--- a/proxy.c
+++ b/proxy.c
@@ -22,7 +22,7 @@
 
 #define MIN(a, b)	((a) < (b) ? (a) : (b))
 
-static struct timeval handshake_timeout = { 5, 0 };
+static const struct timeval handshake_timeout = { 5, 0 };
 
 static void	proxy_tls_readcb(int, short, void *);
 static void	proxy_tls_writecb(int, short, void *);
diff --git a/regress/puny-test.c b/regress/puny-test.c
index b392335..c6757e5 100644
--- a/regress/puny-test.c
+++ b/regress/puny-test.c
@@ -23,7 +23,7 @@
 struct conf conf;
 struct imsgbuf logibuf, servibuf[PROC_MAX];
 
-struct suite {
+const struct suite {
 	const char	*src;
 	const char	*res;
 } t[] = {
@@ -58,7 +58,7 @@ sandbox_logger_process(void)
 int
 main(int argc, char **argv)
 {
-	struct suite *i;
+	const struct suite *i;
 	int failed;
 	char buf[64];		/* name len */
 	const char *parse_err;
diff --git a/sandbox.c b/sandbox.c
index 0ab50d1..d221260 100644
--- a/sandbox.c
+++ b/sandbox.c
@@ -246,7 +246,7 @@ sandbox_logger_process(void)
 #  error "Platform does not support seccomp filter yet"
 #endif
 
-static struct sock_filter filter[] = {
+static const struct sock_filter filter[] = {
 	/* load the *current* architecture */
 	BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
 	    (offsetof(struct seccomp_data, arch))),
@@ -438,7 +438,7 @@ open_landlock(void)
 {
 	int fd;
 
-	struct landlock_ruleset_attr attr = {
+	const struct landlock_ruleset_attr attr = {
 		.handled_access_fs =	LANDLOCK_ACCESS_FS_EXECUTE |
 					LANDLOCK_ACCESS_FS_READ_FILE |
 					LANDLOCK_ACCESS_FS_READ_DIR |
@@ -556,7 +556,7 @@ logger_landlock(void)
 void
 sandbox_server_process(void)
 {
-	struct sock_fprog prog = {
+	const struct sock_fprog prog = {
 		.len = (unsigned short) (sizeof(filter) / sizeof(filter[0])),
 		.filter = filter,
 	};