diff --git a/kdc/config.c b/kdc/config.c
index 267bde750..65a0f84de 100644
--- a/kdc/config.c
+++ b/kdc/config.c
@@ -99,7 +99,7 @@ static struct getargs args[] = {
 	&enable_v4_cross_realm,
 	"respond to kerberos 4 requests from foreign realms"
     },
-    {	"ports",	'P', 	arg_string, &port_str,
+    {	"ports",	'P', 	arg_string, rk_UNCONST(&port_str),
 	"ports to listen to", "portspec"
     },
 #ifdef SUPPORT_DETACH
diff --git a/kdc/hprop.c b/kdc/hprop.c
index 015430925..e3846e932 100644
--- a/kdc/hprop.c
+++ b/kdc/hprop.c
@@ -125,13 +125,14 @@ v5_prop(krb5_context context, HDB *db, hdb_entry_ex *entry, void *appdata)
 
 struct getargs args[] = {
     { "master-key", 'm', arg_string, &mkeyfile, "v5 master key file", "file" },
-    { "database", 'd',	arg_string, &database, "database", "file" },
+    { "database", 'd',	arg_string, rk_UNCONST(&database), "database", "file" },
     { "source",   0,	arg_string, &source_type, "type of database to read",
       "heimdal"
       "|mit-dump"
     },
 
-    { "keytab",   'k',	arg_string, &ktname, "keytab to use for authentication", "keytab" },
+    { "keytab",   'k',	arg_string, rk_UNCONST(&ktname),
+      "keytab to use for authentication", "keytab" },
     { "v5-realm", 'R',  arg_string, &local_realm, "v5 realm to use" },
     { "decrypt",  'D',  arg_flag,   &decrypt_flag,   "decrypt keys" },
     { "encrypt",  'E',  arg_flag,   &encrypt_flag,   "encrypt keys" },
diff --git a/kdc/hpropd.c b/kdc/hpropd.c
index ca90fc9b7..8b360cf42 100644
--- a/kdc/hpropd.c
+++ b/kdc/hpropd.c
@@ -43,7 +43,7 @@ static char *local_realm;
 static char *ktname = NULL;
 
 struct getargs args[] = {
-    { "database", 'd', arg_string, &database, "database", "file" },
+    { "database", 'd', arg_string, rk_UNCONST(&database), "database", "file" },
     { "stdin",    'n', arg_flag, &from_stdin, "read from stdin" },
     { "print",	    0, arg_flag, &print_dump, "print dump to stdout" },
 #ifdef SUPPORT_INETD
diff --git a/kdc/kstash.c b/kdc/kstash.c
index f8df016ee..c005f4239 100644
--- a/kdc/kstash.c
+++ b/kdc/kstash.c
@@ -46,7 +46,7 @@ static int random_key_flag;
 static const char *enctype_str = "des3-cbc-sha1";
 
 static struct getargs args[] = {
-    { "enctype", 'e', arg_string, &enctype_str, "encryption type" },
+    { "enctype", 'e', arg_string, rk_UNCONST(&enctype_str), "encryption type" },
     { "key-file", 'k', arg_string, &keyfile, "master key file", "file" },
     { "convert-file", 0, arg_flag, &convert_flag,
       "just convert keyfile to new format" },
diff --git a/kdc/string2key.c b/kdc/string2key.c
index 316f2278b..c351271e7 100644
--- a/kdc/string2key.c
+++ b/kdc/string2key.c
@@ -51,7 +51,7 @@ struct getargs args[] = {
     { "cell",     'c', arg_string, &cell, "AFS cell to use", "cell" },
     { "password", 'w', arg_string, &password, "Password to use", "password" },
     { "principal",'p', arg_string, &principal, "Kerberos v5 principal to use", "principal" },
-    { "keytype",  'k', arg_string, &keytype_str, "Keytype" },
+    { "keytype",  'k', arg_string, rk_UNCONST(&keytype_str), "Keytype" },
     { "version",    0, arg_flag,   &version, "print version" },
     { "help",       0, arg_flag,   &help, NULL }
 };
diff --git a/kuser/kdestroy.c b/kuser/kdestroy.c
index 36ac5ef5f..07e113e39 100644
--- a/kuser/kdestroy.c
+++ b/kuser/kdestroy.c
@@ -44,9 +44,9 @@ static int dest_tkt_flag = 1;
 static int all_flag = 0;
 
 struct getargs args[] = {
-    { "credential",	0,   arg_string, &credential,
+    { "credential",	0,   arg_string, rk_UNCONST(&credential),
       "remove one credential", "principal" },
-    { "cache",		'c', arg_string, &cache, "cache to destroy", "cache" },
+    { "cache",		'c', arg_string, rk_UNCONST(&cache), "cache to destroy", "cache" },
     { "all",		'A', arg_flag, &all_flag, "destroy all caches" },
 #ifndef NO_AFS
     { "unlog",		0,   arg_negative_flag, &unlog_flag,
diff --git a/lib/kadm5/ipropd_master.c b/lib/kadm5/ipropd_master.c
index 5915c7915..630b6495e 100644
--- a/lib/kadm5/ipropd_master.c
+++ b/lib/kadm5/ipropd_master.c
@@ -733,11 +733,11 @@ static struct getargs args[] = {
     { "keytab", 'k', arg_string, &keytab_str,
       "keytab to get authentication from", "kspec" },
     { "database", 'd', arg_string, &database, "database", "file"},
-    { "slave-stats-file", 0, arg_string, &slave_stats_file,
+    { "slave-stats-file", 0, arg_string, rk_UNCONST(&slave_stats_file),
       "file for slave status information", "file"},
-    { "time-missing", 0, arg_string, &slave_time_missing,
+    { "time-missing", 0, arg_string, rk_UNCONST(&slave_time_missing),
       "time before slave is polled for presence", "time"},
-    { "time-gone", 0, arg_string, &slave_time_gone,
+    { "time-gone", 0, arg_string, rk_UNCONST(&slave_time_gone),
       "time of inactivity after which a slave is considered gone", "time"},
     { "port", 0, arg_string, &port_str,
       "port ipropd will listen to", "port"},
@@ -745,7 +745,7 @@ static struct getargs args[] = {
     { "detach", 0, arg_flag, &detach_from_console,
       "detach from console" },
 #endif
-    { "hostname", 0, arg_string, &master_hostname,
+    { "hostname", 0, arg_string, rk_UNCONST(&master_hostname),
       "hostname of master (if not same as hostname)", "hostname" },
     { "version", 0, arg_flag, &version_flag },
     { "help", 0, arg_flag, &help_flag }
diff --git a/lib/kadm5/ipropd_slave.c b/lib/kadm5/ipropd_slave.c
index 322b928e9..bee97a32e 100644
--- a/lib/kadm5/ipropd_slave.c
+++ b/lib/kadm5/ipropd_slave.c
@@ -472,7 +472,7 @@ static struct getargs args[] = {
     { "detach", 0, arg_flag, &detach_from_console,
       "detach from console" },
 #endif
-    { "hostname", 0, arg_string, &slave_str,
+    { "hostname", 0, arg_string, rk_UNCONST(&slave_str),
       "hostname of slave (if not same as hostname)", "hostname" },
     { "version", 0, arg_flag, &version_flag },
     { "help", 0, arg_flag, &help_flag }
diff --git a/lib/krb5/cache.c b/lib/krb5/cache.c
index 0289d4ed3..211642e56 100644
--- a/lib/krb5/cache.c
+++ b/lib/krb5/cache.c
@@ -134,7 +134,7 @@ krb5_cc_register(krb5_context context,
 	}
     }
     if(i == context->num_cc_ops) {
-	const krb5_cc_ops **o = realloc(context->cc_ops,
+	const krb5_cc_ops **o = realloc(rk_UNCONST(context->cc_ops),
 					(context->num_cc_ops + 1) *
 					sizeof(context->cc_ops[0]));
 	if(o == NULL) {
diff --git a/lib/krb5/context.c b/lib/krb5/context.c
index 640755b31..b6c687093 100644
--- a/lib/krb5/context.c
+++ b/lib/krb5/context.c
@@ -269,7 +269,7 @@ cc_ops_copy(krb5_context context, const krb5_context src_context)
 	return KRB5_CC_NOMEM;
     }
 
-    memcpy(cc_ops, src_context->cc_ops,
+    memcpy(rk_UNCONST(cc_ops), src_context->cc_ops,
 	   sizeof(cc_ops[0]) * src_context->num_cc_ops);
     context->cc_ops = cc_ops;
     context->num_cc_ops = src_context->num_cc_ops;
@@ -559,7 +559,7 @@ krb5_free_context(krb5_context context)
     krb5_free_host_realm (context, context->default_realms);
     krb5_config_file_free (context, context->cf);
     free_error_table (context->et_list);
-    free(context->cc_ops);
+    free(rk_UNCONST(context->cc_ops));
     free(context->kt_types);
     krb5_clear_error_message(context);
     if(context->warn_dest != NULL)