diff --git a/kdc/kerberos5.c b/kdc/kerberos5.c
index 45a72da09..7dcfb1c1d 100644
--- a/kdc/kerberos5.c
+++ b/kdc/kerberos5.c
@@ -1189,7 +1189,7 @@ _kdc_encode_reply(krb5_context context,
 	 * Hide client name for privacy reasons
 	 */
 	if (r->fast.flags.requested_hidden_names) {
-	    Realm anon_realm = KRB5_ANON_REALM;
+	    const Realm anon_realm = KRB5_ANON_REALM;
 
 	    free_Realm(&rep->crealm);
 	    ret = copy_Realm(&anon_realm, &rep->crealm);
@@ -2428,7 +2428,7 @@ _kdc_as_rep(astgs_request_t r)
 
     if (!config->historical_anon_realm &&
         _kdc_is_anonymous(r->context, r->client_princ)) {
-	Realm anon_realm = KRB5_ANON_REALM;
+	const Realm anon_realm = KRB5_ANON_REALM;
 	ret = copy_Realm(&anon_realm, &rep->crealm);
     } else if (f.canonicalize || r->client->flags.force_canonicalize)
 	ret = copy_Realm(&r->canon_client_princ->realm, &rep->crealm);