diff --git a/src/cryptsetup.c b/src/cryptsetup.c
index 61ee090f..93e695f3 100644
--- a/src/cryptsetup.c
+++ b/src/cryptsetup.c
@@ -24,34 +24,34 @@
 #include "cryptsetup.h"
 #include <uuid/uuid.h>
 
-static const char *opt_cipher = NULL;
-static const char *opt_keyslot_cipher = NULL;
-static const char *opt_hash = NULL;
-static const char *opt_json_file = NULL;
-static const char *opt_key_file = NULL;
-static const char *opt_keyfile_stdin = NULL;
-static const char *opt_keyfiles[MAX_KEYFILES];
-static const char *opt_master_key_file = NULL;
-static const char *opt_header_backup_file = NULL;
-static const char *opt_uuid = NULL;
-static const char *opt_header_device = NULL;
-static const char *opt_type = NULL;
-static const char *opt_pbkdf = NULL;
-static const char *opt_priority = NULL; /* normal */
-static const char *opt_integrity = NULL; /* none */
-static const char *opt_key_description = NULL;
-static const char *opt_label = NULL;
-static const char *opt_subsystem = NULL;
-static const char *opt_active_name = NULL;
-static const char *opt_resilience_mode = NULL; /* default value "checksum" */
-static const char *opt_resilience_hash = NULL; /* default value "sha256" */
+static char *opt_cipher = NULL;
+static char *opt_keyslot_cipher = NULL;
+static char *opt_hash = NULL;
+static char *opt_json_file = NULL;
+static char *opt_key_file = NULL;
+static char *opt_keyfile_stdin = NULL;
+static char *opt_keyfiles[MAX_KEYFILES];
+static char *opt_master_key_file = NULL;
+static char *opt_header_backup_file = NULL;
+static char *opt_uuid = NULL;
+static char *opt_header_device = NULL;
+static char *opt_type = NULL;
+static char *opt_pbkdf = NULL;
+static char *opt_priority = NULL; /* normal */
+static char *opt_integrity = NULL; /* none */
+static char *opt_key_description = NULL;
+static char *opt_label = NULL;
+static char *opt_subsystem = NULL;
+static char *opt_active_name = NULL;
+static char *opt_resilience_mode = NULL; /* default value "checksum" */
+static char *opt_resilience_hash = NULL; /* default value "sha256" */
 
 /* helper strings converted to uint64_t later */
-static const char *opt_reduce_size_str = NULL;
-static const char *opt_hotzone_size_str = NULL;
-static const char *opt_device_size_str = NULL;
-static const char *opt_luks2_metadata_size_str = NULL;
-static const char *opt_luks2_keyslots_size_str = NULL;
+static char *opt_reduce_size_str = NULL;
+static char *opt_hotzone_size_str = NULL;
+static char *opt_device_size_str = NULL;
+static char *opt_luks2_metadata_size_str = NULL;
+static char *opt_luks2_keyslots_size_str = NULL;
 
 static uint64_t opt_reduce_size = 0;
 static uint64_t opt_hotzone_size = 0;
@@ -500,7 +500,7 @@ static int action_open_tcrypt(void)
 {
 	struct crypt_device *cd = NULL;
 	struct crypt_params_tcrypt params = {
-		.keyfiles = opt_keyfiles,
+		.keyfiles = CONST_CAST(const char **)opt_keyfiles,
 		.keyfiles_count = opt_keyfiles_count,
 		.flags = CRYPT_TCRYPT_LEGACY_MODES |
 			 (opt_veracrypt ? CRYPT_TCRYPT_VERA_MODES : 0),
@@ -618,7 +618,7 @@ static int action_tcryptDump(void)
 {
 	struct crypt_device *cd = NULL;
 	struct crypt_params_tcrypt params = {
-		.keyfiles = opt_keyfiles,
+		.keyfiles = CONST_CAST(const char **)opt_keyfiles,
 		.keyfiles_count = opt_keyfiles_count,
 		.flags = CRYPT_TCRYPT_LEGACY_MODES |
 			 (opt_veracrypt ? CRYPT_TCRYPT_VERA_MODES : 0),
@@ -3615,7 +3615,7 @@ int main(int argc, const char **argv)
 		char *endp;
 
 		if (r == 6) {
-			const char *kf = poptGetOptArg(popt_context);
+			char *kf = poptGetOptArg(popt_context);
 			if (tools_is_stdin(kf))
 				opt_keyfile_stdin = kf;
 			else if (opt_keyfiles_count < MAX_KEYFILES)
diff --git a/src/cryptsetup_reencrypt.c b/src/cryptsetup_reencrypt.c
index 2d70f320..3d86960d 100644
--- a/src/cryptsetup_reencrypt.c
+++ b/src/cryptsetup_reencrypt.c
@@ -29,18 +29,18 @@
 
 #define NO_UUID "cafecafe-cafe-cafe-cafe-cafecafeeeee"
 
-static const char *opt_cipher = NULL;
-static const char *opt_hash = NULL;
-static const char *opt_key_file = NULL;
-static const char *opt_master_key_file = NULL;
-static const char *opt_uuid = NULL;
-static const char *opt_type = NULL;
-static const char *opt_pbkdf = NULL;
-static const char *opt_header_device = NULL;
+static char *opt_cipher = NULL;
+static char *opt_hash = NULL;
+static char *opt_key_file = NULL;
+static char *opt_master_key_file = NULL;
+static char *opt_uuid = NULL;
+static char *opt_type = NULL;
+static char *opt_pbkdf = NULL;
+static char *opt_header_device = NULL;
 
 /* helper strings converted to uint64_t later */
-static const char *opt_reduce_size_str = NULL;
-static const char *opt_device_size_str = NULL;
+static char *opt_reduce_size_str = NULL;
+static char *opt_device_size_str = NULL;
 
 static uint64_t opt_reduce_size = 0;
 static uint64_t opt_device_size = 0;
diff --git a/src/integritysetup.c b/src/integritysetup.c
index ebffd055..6d07bdd6 100644
--- a/src/integritysetup.c
+++ b/src/integritysetup.c
@@ -27,16 +27,16 @@
 #define DEFAULT_ALG_NAME "crc32c"
 #define MAX_KEY_SIZE 4096
 
-static const char *opt_data_device = NULL;
-static const char *opt_integrity = NULL; /* DEFAULT_ALG_NAME */
-static const char *opt_integrity_key_file = NULL;
-static const char *opt_journal_integrity = NULL; /* none */
-static const char *opt_journal_integrity_key_file = NULL;
-static const char *opt_journal_crypt = NULL; /* none */
-static const char *opt_journal_crypt_key_file = NULL;
+static char *opt_data_device = NULL;
+static char *opt_integrity = NULL; /* DEFAULT_ALG_NAME */
+static char *opt_integrity_key_file = NULL;
+static char *opt_journal_integrity = NULL; /* none */
+static char *opt_journal_integrity_key_file = NULL;
+static char *opt_journal_crypt = NULL; /* none */
+static char *opt_journal_crypt_key_file = NULL;
 
 /* helper strings converted to uint64_t later */
-static const char *opt_journal_size_str = NULL;
+static char *opt_journal_size_str = NULL;
 
 static uint64_t opt_journal_size = 0;
 
diff --git a/src/veritysetup.c b/src/veritysetup.c
index 344c7e44..b58b5c16 100644
--- a/src/veritysetup.c
+++ b/src/veritysetup.c
@@ -23,11 +23,11 @@
 
 #define PACKAGE_VERITY "veritysetup"
 
-static const char *opt_fec_device = NULL;
-static const char *opt_hash_algorithm = NULL;
-static const char *opt_salt = NULL;
-static const char *opt_uuid = NULL;
-static const char *opt_root_hash_signature = NULL;
+static char *opt_fec_device = NULL;
+static char *opt_hash_algorithm = NULL;
+static char *opt_salt = NULL;
+static char *opt_uuid = NULL;
+static char *opt_root_hash_signature = NULL;
 
 static int opt_use_superblock = 1;
 static int opt_fec_roots = DEFAULT_VERITY_FEC_ROOTS;