diff --git a/lib/crypto_backend/crypto_storage.c b/lib/crypto_backend/crypto_storage.c
index 9f8fa839..edd4db7d 100644
--- a/lib/crypto_backend/crypto_storage.c
+++ b/lib/crypto_backend/crypto_storage.c
@@ -77,7 +77,7 @@ static int crypt_sector_iv_init(struct crypt_sector_iv *ctx,
 		ctx->type = IV_PLAIN;
 	} else if (!strncasecmp(iv_name, "essiv:", 6)) {
 		struct crypt_hash *h = NULL;
-		char *hash_name = strchr(iv_name, ':');
+		const char *hash_name = strchr(iv_name, ':');
 		int hash_size;
 		char tmp[256];
 
diff --git a/lib/libdevmapper.c b/lib/libdevmapper.c
index 69a677fe..13ec0317 100644
--- a/lib/libdevmapper.c
+++ b/lib/libdevmapper.c
@@ -3287,7 +3287,7 @@ int dm_is_dm_kernel_name(const char *name)
 int dm_uuid_cmp(const char *dm_uuid, const char *hdr_uuid)
 {
 	int i, j;
-	char *str;
+	const char *str;
 
 	if (!dm_uuid || !hdr_uuid)
 		return -EINVAL;
@@ -3322,7 +3322,7 @@ int dm_uuid_cmp(const char *dm_uuid, const char *hdr_uuid)
 int dm_uuid_integrity_cmp(const char *dm_uuid, const char *dmi_uuid)
 {
 	int i;
-	char *str, *stri;
+	const char *str, *stri;
 
 	if (!dm_uuid || !dmi_uuid)
 		return -EINVAL;
diff --git a/lib/luks1/keyencryption.c b/lib/luks1/keyencryption.c
index 5698318c..de8aa30e 100644
--- a/lib/luks1/keyencryption.c
+++ b/lib/luks1/keyencryption.c
@@ -18,7 +18,8 @@
 static void _error_hint(struct crypt_device *ctx, const char *device,
 			const char *cipher, const char *mode, size_t keyLength)
 {
-	char *c, cipher_spec[MAX_CIPHER_LEN * 3];
+	const char *c;
+	char cipher_spec[MAX_CIPHER_LEN * 3];
 
 	if (snprintf(cipher_spec, sizeof(cipher_spec), "%s-%s", cipher, mode) < 0)
 		return;
diff --git a/lib/tcrypt/tcrypt.c b/lib/tcrypt/tcrypt.c
index 2fd95399..8fbe6514 100644
--- a/lib/tcrypt/tcrypt.c
+++ b/lib/tcrypt/tcrypt.c
@@ -1002,8 +1002,10 @@ static int TCRYPT_status_one(struct crypt_device *cd, const char *name,
 {
 	struct crypt_dm_active_device dmd;
 	struct dm_target *tgt = &dmd.segment;
-	char dm_name[PATH_MAX], *c;
+	const char *c;
+	char dm_name[PATH_MAX];
 	int r;
+	size_t cipher_len = MAX_CIPHER_LEN;
 
 	if (snprintf(dm_name, sizeof(dm_name), "%s_%d", name, index) < 0)
 		return -ENOMEM;
@@ -1027,9 +1029,9 @@ static int TCRYPT_status_one(struct crypt_device *cd, const char *name,
 
 	if (is_tcrypt_subdev(dmd.uuid, base_uuid)) {
 		if ((c = strchr(tgt->u.crypt.cipher, '-')))
-			*c = '\0';
+			cipher_len = c - tgt->u.crypt.cipher;
 		strcat(cipher, "-");
-		strncat(cipher, tgt->u.crypt.cipher, MAX_CIPHER_LEN);
+		strncat(cipher, tgt->u.crypt.cipher, cipher_len);
 		*key_size += crypt_volume_key_length(tgt->u.crypt.vk);
 		tcrypt_hdr->d.mk_offset = tgt->u.crypt.offset * SECTOR_SIZE;
 		device_free(cd, *device);
diff --git a/lib/utils_keyring.c b/lib/utils_keyring.c
index 3106a606..73df3461 100644
--- a/lib/utils_keyring.c
+++ b/lib/utils_keyring.c
@@ -299,7 +299,8 @@ const char *key_type_name(key_type_t type)
 
 key_type_t keyring_type_and_name(const char *key_name, const char **name)
 {
-	char type[16], *name_tmp;
+	const char *name_tmp;
+	char type[16];
 	size_t type_len;
 
 	if (!key_name || key_name[0] != '%')