diff --git a/kdc/pkinit.c b/kdc/pkinit.c
index bd24b8fb7..b718205a4 100644
--- a/kdc/pkinit.c
+++ b/kdc/pkinit.c
@@ -110,7 +110,7 @@ pk_check_pkauthenticator_win2k(krb5_context context,
 
 static krb5_error_code
 pk_check_pkauthenticator(krb5_context context,
-			 PKAuthenticator *a,
+			 const PKAuthenticator *a,
 			 const KDC_REQ *req)
 {
     krb5_error_code ret;