diff --git a/lib/gssapi/gssapi/gssapi.h b/lib/gssapi/gssapi/gssapi.h
index 9f1386e55..8484c2c2d 100644
--- a/lib/gssapi/gssapi/gssapi.h
+++ b/lib/gssapi/gssapi/gssapi.h
@@ -781,7 +781,7 @@ gss_release_oid
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
 gss_oid_to_str(
 	    OM_uint32 * /*minor_status*/,
-	    gss_OID /* oid */,
+	    gss_const_OID /* oid */,
 	    gss_buffer_t /* str */
            );
 
diff --git a/lib/gssapi/krb5/authorize_localname.c b/lib/gssapi/krb5/authorize_localname.c
index 0c13428dd..b4fc574ab 100644
--- a/lib/gssapi/krb5/authorize_localname.c
+++ b/lib/gssapi/krb5/authorize_localname.c
@@ -58,8 +58,7 @@ _gsskrb5_authorize_localname(OM_uint32 *minor_status,
     user[user_name->length] = '\0';
 
     *minor_status = 0;
-    /* XXX krb5_kuserok should take krb5_const_principal */
-    user_ok = krb5_kuserok(context, rk_UNCONST(princ), user);
+    user_ok = krb5_kuserok(context, princ, user);
 
     free(user);
 
diff --git a/lib/gssapi/mech/gss_oid_to_str.c b/lib/gssapi/mech/gss_oid_to_str.c
index d8e188da0..7a18906ed 100644
--- a/lib/gssapi/mech/gss_oid_to_str.c
+++ b/lib/gssapi/mech/gss_oid_to_str.c
@@ -34,7 +34,7 @@
 #include "mech_locl.h"
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
-gss_oid_to_str(OM_uint32 *minor_status, gss_OID oid, gss_buffer_t oid_str)
+gss_oid_to_str(OM_uint32 *minor_status, gss_const_OID oid, gss_buffer_t oid_str)
 {
     int ret;
     size_t size;
diff --git a/lib/gssapi/spnego/compat.c b/lib/gssapi/spnego/compat.c
index 6a5be74e1..4ecf29440 100644
--- a/lib/gssapi/spnego/compat.c
+++ b/lib/gssapi/spnego/compat.c
@@ -540,9 +540,8 @@ _gss_spnego_log_mech(const char *prefix, gss_const_OID oid)
     if (!_gss_mg_log_level(10))
 	return;
 
-    /* XXX gss_oid_to_str should take gss_const_OID */
     if (oid == GSS_C_NO_OID ||
-	gss_oid_to_str(&junk, rk_UNCONST(oid), &oidbuf) != GSS_S_COMPLETE) {
+	gss_oid_to_str(&junk, oid, &oidbuf) != GSS_S_COMPLETE) {
 	_gss_mg_log(10, "spnego: %s (null)", prefix);
 	return;
     }
diff --git a/lib/gssapi/spnego/negoex_util.c b/lib/gssapi/spnego/negoex_util.c
index 4cf038b61..2cecc35ed 100644
--- a/lib/gssapi/spnego/negoex_util.c
+++ b/lib/gssapi/spnego/negoex_util.c
@@ -923,8 +923,7 @@ _gss_negoex_add_auth_mech(OM_uint32 *minor,
 	return GSS_S_FAILURE;
     }
 
-    /* XXX gss_duplicate_oid should take gss_const_OID */
-    major = gss_duplicate_oid(minor, (gss_OID)rk_UNCONST(oid), &mech->oid);
+    major = gss_duplicate_oid(minor, oid, &mech->oid);
     if (major != GSS_S_COMPLETE) {
 	free(mech);
 	return major;
diff --git a/lib/gssapi/test_names.c b/lib/gssapi/test_names.c
index 71b3a7ca8..75ecae30f 100644
--- a/lib/gssapi/test_names.c
+++ b/lib/gssapi/test_names.c
@@ -280,7 +280,7 @@ check_name_attrs(void)
 
     assert_attr(n, GSS_KRB5_NAME_ATTRIBUTE_BASE_URN "ticket-authz-data",
                 GSS_S_COMPLETE, &v, NULL, 0, 1, 0);
-    free(v.value);		/* XXX !!! ??? */
+    free(v.value);
 
     attr_set.count = 7;
     assert_attr_set(n, &attr_set);