diff --git a/lib/luks2/luks2_internal.h b/lib/luks2/luks2_internal.h
index 6c4f722f..538c967a 100644
--- a/lib/luks2/luks2_internal.h
+++ b/lib/luks2/luks2_internal.h
@@ -164,6 +164,11 @@ typedef struct  {
 	digest_dump_func   dump;
 } digest_handler;
 
+typedef struct {
+	/* public token handler */
+	const crypt_token_handler *h;
+} token_handler;
+
 int LUKS2_find_area_gap(struct crypt_device *cd, struct luks2_hdr *hdr,
 			size_t keylength, uint64_t *area_offset, uint64_t *area_length);
 int LUKS2_find_area_max_gap(struct crypt_device *cd, struct luks2_hdr *hdr,
diff --git a/lib/luks2/luks2_token.c b/lib/luks2/luks2_token.c
index 10e6fc5e..a1dc6c59 100644
--- a/lib/luks2/luks2_token.c
+++ b/lib/luks2/luks2_token.c
@@ -26,10 +26,11 @@
 /* Builtin tokens */
 extern const crypt_token_handler keyring_handler;
 
-static const crypt_token_handler *token_handlers[LUKS2_TOKENS_MAX] = {
+static token_handler token_handlers[LUKS2_TOKENS_MAX] = {
 	/* keyring builtin token */
-	&keyring_handler,
-	NULL
+	{
+	  .h = &keyring_handler
+	}
 };
 
 static int is_builtin_candidate(const char *type)
@@ -46,8 +47,8 @@ int crypt_token_register(const crypt_token_handler *handler)
 		return -EINVAL;
 	}
 
-	for (i = 0; i < LUKS2_TOKENS_MAX && token_handlers[i]; i++) {
-		if (!strcmp(token_handlers[i]->name, handler->name)) {
+	for (i = 0; i < LUKS2_TOKENS_MAX && token_handlers[i].h; i++) {
+		if (!strcmp(token_handlers[i].h->name, handler->name)) {
 			log_dbg(NULL, "Keyslot handler %s is already registered.", handler->name);
 			return -EINVAL;
 		}
@@ -56,7 +57,7 @@ int crypt_token_register(const crypt_token_handler *handler)
 	if (i == LUKS2_TOKENS_MAX)
 		return -EINVAL;
 
-	token_handlers[i] = handler;
+	token_handlers[i].h = handler;
 	return 0;
 }
 
@@ -65,9 +66,9 @@ static const crypt_token_handler
 {
 	int i;
 
-	for (i = 0; i < LUKS2_TOKENS_MAX && token_handlers[i]; i++)
-		if (!strcmp(token_handlers[i]->name, type))
-			return token_handlers[i];
+	for (i = 0; i < LUKS2_TOKENS_MAX && token_handlers[i].h; i++)
+		if (!strcmp(token_handlers[i].h->name, type))
+			return token_handlers[i].h;
 
 	return NULL;
 }