diff --git a/bin/named/server.c b/bin/named/server.c
index 7f1e5fe8ab..148edb5bfc 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -9689,7 +9689,7 @@ get_matching_view(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
 		if (message->rdclass == view->rdclass ||
 		    message->rdclass == dns_rdataclass_any)
 		{
-			dns_name_t *tsig = NULL;
+			const dns_name_t *tsig = NULL;
 
 			*sigresult = dns_message_rechecksig(message, view);
 			if (*sigresult == ISC_R_SUCCESS) {
diff --git a/lib/dns/message.c b/lib/dns/message.c
index 3d7a00cf30..a31e248133 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -3064,7 +3064,7 @@ dns_message_signer(dns_message_t *msg, dns_name_t *signer) {
 		dns_name_clone(&sig.signer, signer);
 		dns_rdata_freestruct(&sig);
 	} else {
-		dns_name_t *identity;
+		const dns_name_t *identity;
 		dns_rdata_any_tsig_t tsig;
 
 		result = dns_rdataset_first(msg->tsig);
diff --git a/lib/dns/tkey.c b/lib/dns/tkey.c
index 2629174f5a..c08b52a75d 100644
--- a/lib/dns/tkey.c
+++ b/lib/dns/tkey.c
@@ -661,7 +661,7 @@ process_deletetkey(dns_name_t *signer, dns_name_t *name,
 {
 	isc_result_t result;
 	dns_tsigkey_t *tsigkey = NULL;
-	dns_name_t *identity;
+	const dns_name_t *identity;
 
 	result = dns_tsigkey_find(&tsigkey, name, &tkeyin->algorithm, ring);
 	if (result != ISC_R_SUCCESS) {
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 44f2ec941d..be0865c891 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -13734,7 +13734,7 @@ dns_zone_notifyreceive(dns_zone_t *zone, isc_sockaddr_t *from,
 	uint32_t serial = 0;
 	bool have_serial = false;
 	dns_tsigkey_t *tsigkey;
-	dns_name_t *tsig;
+	const dns_name_t *tsig;
 
 	REQUIRE(DNS_ZONE_VALID(zone));