diff --git a/lib/gssapi/gss-token.c b/lib/gssapi/gss-token.c
index a4c02967c..7c4ff7a0a 100644
--- a/lib/gssapi/gss-token.c
+++ b/lib/gssapi/gss-token.c
@@ -412,7 +412,7 @@ initiate_many(gss_name_t service, int delegate, int negotiate, int memcache,
 		K5BAIL(krb5_init_context(&kctx));
 		K5BAIL(krb5_cc_default(kctx, &def_cache));
 		K5BAIL(krb5_cc_resolve(kctx, "MEMORY:mem_cache", &mem_cache));
-		putenv("KRB5CCNAME=MEMORY:mem_cache");
+		putenv(rk_UNCONST("KRB5CCNAME=MEMORY:mem_cache"));
 	}
 
 	for (i=0; i < count; i++) {
diff --git a/lib/roken/test-detach.c b/lib/roken/test-detach.c
index 0f4636eb6..edc266028 100644
--- a/lib/roken/test-detach.c
+++ b/lib/roken/test-detach.c
@@ -75,7 +75,7 @@ int main(int argc, char **argv)
     } else {
         if (argc == 2)
             /* Make sure we re-exec on the child-side of fork() (not WIN32) */
-            putenv("ROKEN_DETACH_USE_EXEC=1");
+            putenv(rk_UNCONST("ROKEN_DETACH_USE_EXEC=1"));
 	fd = roken_detach_prep(argc, argv, "--daemon-child");
         if (fd == -1)
             errx(1, "bad");
diff --git a/lib/roken/test-getuserinfo.c b/lib/roken/test-getuserinfo.c
index 4feae177a..bbf6f0f8b 100644
--- a/lib/roken/test-getuserinfo.c
+++ b/lib/roken/test-getuserinfo.c
@@ -104,9 +104,9 @@ main(void)
     if (!issuid() && getuid() != 0) {
         const char *s, *s2;
 
-        putenv("USER=h5lfoouser");
-        putenv("HOME=/no/such/dir/h5lfoouser");
-        putenv("SHELL=/no/such/shell");
+        putenv(rk_UNCONST("USER=h5lfoouser"));
+        putenv(rk_UNCONST("HOME=/no/such/dir/h5lfoouser"));
+        putenv(rk_UNCONST("SHELL=/no/such/shell"));
         if ((s = roken_get_username(buf, sizeof(buf))) == NULL ||
             strcmp("h5lfoouser", s) != 0) {
             warnx("roken_get_username() (%s) did not honor $USER", s);