diff --git a/kdc/kerberos5.c b/kdc/kerberos5.c
index 118451ba7..37f709e89 100644
--- a/kdc/kerberos5.c
+++ b/kdc/kerberos5.c
@@ -1336,8 +1336,8 @@ get_pa_etype_info(krb5_context context,
  *
  */
 
-extern int _krb5_AES_SHA1_string_to_default_iterator;
-extern int _krb5_AES_SHA2_string_to_default_iterator;
+extern const int _krb5_AES_SHA1_string_to_default_iterator;
+extern const int _krb5_AES_SHA2_string_to_default_iterator;
 
 static krb5_error_code
 make_s2kparams(int value, size_t len, krb5_data **ps2kparams)
diff --git a/lib/krb5/salt-aes-sha1.c b/lib/krb5/salt-aes-sha1.c
index edd066df4..2c556f1cb 100644
--- a/lib/krb5/salt-aes-sha1.c
+++ b/lib/krb5/salt-aes-sha1.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-int _krb5_AES_SHA1_string_to_default_iterator = 4096;
+const int _krb5_AES_SHA1_string_to_default_iterator = 4096;
 
 static krb5_error_code
 AES_SHA1_string_to_key(krb5_context context,
diff --git a/lib/krb5/salt-aes-sha2.c b/lib/krb5/salt-aes-sha2.c
index bc674bd2d..9de1c280f 100644
--- a/lib/krb5/salt-aes-sha2.c
+++ b/lib/krb5/salt-aes-sha2.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-int _krb5_AES_SHA2_string_to_default_iterator = 32768;
+const int _krb5_AES_SHA2_string_to_default_iterator = 32768;
 
 static krb5_error_code
 AES_SHA2_string_to_key(krb5_context context,