diff --git a/examples/simplegrep.c b/examples/simplegrep.c
index d6bd4b39..b4b287e8 100644
--- a/examples/simplegrep.c
+++ b/examples/simplegrep.c
@@ -150,7 +150,7 @@ int main(int argc, char *argv[]) {
     }
 
     char *pattern = argv[1];
-    char *inputFN = argv[2];
+    const char *inputFN = argv[2];
 
     /* First, we attempt to compile the pattern provided on the command line.
      * We assume 'DOTALL' semantics, meaning that the '.' meta-character will
diff --git a/src/nfa/castle.c b/src/nfa/castle.c
index 35b202a2..b6fadc75 100644
--- a/src/nfa/castle.c
+++ b/src/nfa/castle.c
@@ -94,8 +94,8 @@ char subCastleReportCurrent(const struct Castle *c, struct mq *q,
     const struct SubCastle *sub = getSubCastle(c, subIdx);
     const struct RepeatInfo *info = getRepeatInfo(sub);
 
-    union RepeatControl *rctrl = getControl(q->state, sub);
-    char *rstate = (char *)q->streamState + sub->streamStateOffset +
+    const union RepeatControl *rctrl = getControl(q->state, sub);
+    const char *rstate = (char *)q->streamState + sub->streamStateOffset +
                    info->packedCtrlSize;
     enum RepeatMatch match =
         repeatHasMatch(info, rctrl, rstate, offset);
@@ -118,10 +118,10 @@ int castleReportCurrent(const struct Castle *c, struct mq *q) {
 
     if (c->exclusive) {
         u8 *active = (u8 *)q->streamState;
-        u8 *groups = active + c->groupIterOffset;
+        const u8 *groups = active + c->groupIterOffset;
         for (u32 i = mmbit_iterate(groups, c->numGroups, MMB_INVALID);
              i != MMB_INVALID; i = mmbit_iterate(groups, c->numGroups, i)) {
-            u8 *cur = active + i * c->activeIdxSize;
+            const u8 *cur = active + i * c->activeIdxSize;
             const u32 activeIdx = partial_load_u32(cur, c->activeIdxSize);
             DEBUG_PRINTF("subcastle %u\n", activeIdx);
             if (subCastleReportCurrent(c, q,
@@ -156,8 +156,8 @@ char subCastleInAccept(const struct Castle *c, struct mq *q,
     }
     const struct RepeatInfo *info = getRepeatInfo(sub);
 
-    union RepeatControl *rctrl = getControl(q->state, sub);
-    char *rstate = (char *)q->streamState + sub->streamStateOffset +
+    const union RepeatControl *rctrl = getControl(q->state, sub);
+    const char *rstate = (char *)q->streamState + sub->streamStateOffset +
                    info->packedCtrlSize;
     enum RepeatMatch match =
         repeatHasMatch(info, rctrl, rstate, offset);
@@ -180,10 +180,10 @@ char castleInAccept(const struct Castle *c, struct mq *q,
 
     if (c->exclusive) {
         u8 *active = (u8 *)q->streamState;
-        u8 *groups = active + c->groupIterOffset;
+        const u8 *groups = active + c->groupIterOffset;
         for (u32 i = mmbit_iterate(groups, c->numGroups, MMB_INVALID);
              i != MMB_INVALID; i = mmbit_iterate(groups, c->numGroups, i)) {
-            u8 *cur = active + i * c->activeIdxSize;
+            const u8 *cur = active + i * c->activeIdxSize;
             const u32 activeIdx = partial_load_u32(cur, c->activeIdxSize);
             DEBUG_PRINTF("subcastle %u\n", activeIdx);
             if (subCastleInAccept(c, q, report, offset, activeIdx)) {
@@ -213,8 +213,8 @@ void subCastleDeactivateStaleSubs(const struct Castle *c, const u64a offset,
     const struct SubCastle *sub = getSubCastle(c, subIdx);
     const struct RepeatInfo *info = getRepeatInfo(sub);
 
-    union RepeatControl *rctrl = getControl(full_state, sub);
-    char *rstate = (char *)stream_state + sub->streamStateOffset +
+    const union RepeatControl *rctrl = getControl(full_state, sub);
+    const char *rstate = (char *)stream_state + sub->streamStateOffset +
                        info->packedCtrlSize;
 
     if (repeatHasMatch(info, rctrl, rstate, offset) == REPEAT_STALE) {
@@ -242,10 +242,10 @@ void castleDeactivateStaleSubs(const struct Castle *c, const u64a offset,
 
     if (c->exclusive) {
         u8 *active = (u8 *)stream_state;
-        u8 *groups = active + c->groupIterOffset;
+        const u8 *groups = active + c->groupIterOffset;
         for (u32 i = mmbit_iterate(groups, c->numGroups, MMB_INVALID);
              i != MMB_INVALID; i = mmbit_iterate(groups, c->numGroups, i)) {
-            u8 *cur = active + i * c->activeIdxSize;
+            const u8 *cur = active + i * c->activeIdxSize;
             const u32 activeIdx = partial_load_u32(cur, c->activeIdxSize);
             DEBUG_PRINTF("subcastle %u\n", activeIdx);
             subCastleDeactivateStaleSubs(c, offset, full_state,
@@ -329,8 +329,8 @@ void subCastleFindMatch(const struct Castle *c, const u64a begin,
                         size_t *mloc, char *found, const u32 subIdx) {
     const struct SubCastle *sub = getSubCastle(c, subIdx);
     const struct RepeatInfo *info = getRepeatInfo(sub);
-    union RepeatControl *rctrl = getControl(full_state, sub);
-    char *rstate = (char *)stream_state + sub->streamStateOffset +
+    const union RepeatControl *rctrl = getControl(full_state, sub);
+    const char *rstate = (char *)stream_state + sub->streamStateOffset +
                    info->packedCtrlSize;
 
     u64a match = repeatNextMatch(info, rctrl, rstate, begin);
@@ -374,10 +374,10 @@ char castleFindMatch(const struct Castle *c, const u64a begin, const u64a end,
 
     if (c->exclusive) {
         u8 *active = (u8 *)stream_state;
-        u8 *groups = active + c->groupIterOffset;
+        const u8 *groups = active + c->groupIterOffset;
         for (u32 i = mmbit_iterate(groups, c->numGroups, MMB_INVALID);
              i != MMB_INVALID; i = mmbit_iterate(groups, c->numGroups, i)) {
-            u8 *cur = active + i * c->activeIdxSize;
+            const u8 *cur = active + i * c->activeIdxSize;
             const u32 activeIdx = partial_load_u32(cur, c->activeIdxSize);
             DEBUG_PRINTF("subcastle %u\n", activeIdx);
             subCastleFindMatch(c, begin, end, full_state, stream_state, mloc,
@@ -386,7 +386,7 @@ char castleFindMatch(const struct Castle *c, const u64a begin, const u64a end,
     }
 
     if (c->exclusive != PURE_EXCLUSIVE) {
-        u8 *active = (u8 *)stream_state + c->activeOffset;
+        const u8 *active = (u8 *)stream_state + c->activeOffset;
         for (u32 i = mmbit_iterate(active, c->numRepeats, MMB_INVALID);
              i != MMB_INVALID;
              i = mmbit_iterate(active, c->numRepeats, i)) {
@@ -495,7 +495,7 @@ char castleMatchLoop(const struct Castle *c, const u64a begin, const u64a end,
             u8 *groups = active + c->groupIterOffset;
             for (u32 i = mmbit_iterate(groups, c->numGroups, MMB_INVALID);
                  i != MMB_INVALID; i = mmbit_iterate(groups, c->numGroups, i)) {
-                u8 *cur = active + i * c->activeIdxSize;
+                const u8 *cur = active + i * c->activeIdxSize;
                 u32 activeIdx = partial_load_u32(cur, c->activeIdxSize);
                 u64a match = subCastleNextMatch(c, full_state, stream_state,
                                                 loc, activeIdx);
@@ -796,7 +796,7 @@ char nfaExecCastle_Q_i(const struct NFA *n, struct mq *q, s64a end,
 
         char found = 0;
         if (c->exclusive) {
-            u8 *groups = (u8 *)q->streamState + c->groupIterOffset;
+            const u8 *groups = (u8 *)q->streamState + c->groupIterOffset;
             found = mmbit_any(groups, c->numGroups);
         }
 
@@ -863,7 +863,7 @@ char nfaExecCastle_Q_i(const struct NFA *n, struct mq *q, s64a end,
     }
 
     if (c->exclusive) {
-        u8 *groups = (u8 *)q->streamState + c->groupIterOffset;
+        const u8 *groups = (u8 *)q->streamState + c->groupIterOffset;
         if (mmbit_any_precise(groups, c->numGroups)) {
             return 1;
         }
@@ -957,7 +957,7 @@ char nfaExecCastle_QR(const struct NFA *n, struct mq *q, ReportID report) {
 
     char found = 0;
     if (c->exclusive) {
-        u8 *groups = (u8 *)q->streamState + c->groupIterOffset;
+        const u8 *groups = (u8 *)q->streamState + c->groupIterOffset;
         found = mmbit_any_precise(groups, c->numGroups);
 
     }
@@ -1005,10 +1005,10 @@ char nfaExecCastle_inAnyAccept(const struct NFA *n, struct mq *q) {
 
     if (c->exclusive) {
         u8 *active = (u8 *)q->streamState;
-        u8 *groups = active + c->groupIterOffset;
+        const u8 *groups = active + c->groupIterOffset;
         for (u32 i = mmbit_iterate(groups, c->numGroups, MMB_INVALID);
              i != MMB_INVALID; i = mmbit_iterate(groups, c->numGroups, i)) {
-            u8 *cur = active + i * c->activeIdxSize;
+            const u8 *cur = active + i * c->activeIdxSize;
             const u32 activeIdx = partial_load_u32(cur, c->activeIdxSize);
             DEBUG_PRINTF("subcastle %u\n", activeIdx);
             const struct SubCastle *sub = getSubCastle(c, activeIdx);
@@ -1077,7 +1077,7 @@ void subCastleQueueCompressState(const struct Castle *c, const u32 subIdx,
                                  const struct mq *q, const u64a offset) {
     const struct SubCastle *sub = getSubCastle(c, subIdx);
     const struct RepeatInfo *info = getRepeatInfo(sub);
-    union RepeatControl *rctrl = getControl(q->state, sub);
+    const union RepeatControl *rctrl = getControl(q->state, sub);
     char *packed = (char *)q->streamState + sub->streamStateOffset;
     DEBUG_PRINTF("sub %u next match %llu\n", subIdx,
                  repeatNextMatch(info, rctrl,
@@ -1098,10 +1098,10 @@ char nfaExecCastle_queueCompressState(const struct NFA *n, const struct mq *q,
     DEBUG_PRINTF("offset=%llu\n", offset);
     if (c->exclusive) {
         u8 *active = (u8 *)q->streamState;
-        u8 *groups = active + c->groupIterOffset;
+        const u8 *groups = active + c->groupIterOffset;
         for (u32 i = mmbit_iterate(groups, c->numGroups, MMB_INVALID);
              i != MMB_INVALID; i = mmbit_iterate(groups, c->numGroups, i)) {
-            u8 *cur = active + i * c->activeIdxSize;
+            const u8 *cur = active + i * c->activeIdxSize;
             const u32 activeIdx = partial_load_u32(cur, c->activeIdxSize);
             DEBUG_PRINTF("packing state for sub %u\n", activeIdx);
             subCastleQueueCompressState(c, activeIdx, q, offset);
diff --git a/src/nfa/gough.c b/src/nfa/gough.c
index 44acd4c2..d0ea0bbd 100644
--- a/src/nfa/gough.c
+++ b/src/nfa/gough.c
@@ -981,7 +981,7 @@ char nfaExecGough8_reportCurrent(const struct NFA *n, struct mq *q) {
     void *ctxt = q->context;
     u8 s = *(u8 *)q->state;
     u64a offset = q_cur_offset(q);
-    struct gough_som_info *som = getSomInfo(q->state);
+    const struct gough_som_info *som = getSomInfo(q->state);
     assert(q_cur_type(q) == MQE_START);
     assert(s);
 
@@ -1004,7 +1004,7 @@ char nfaExecGough16_reportCurrent(const struct NFA *n, struct mq *q) {
     u16 s = *(u16 *)q->state;
     const struct mstate_aux *aux = get_aux(m, s);
     u64a offset = q_cur_offset(q);
-    struct gough_som_info *som = getSomInfo(q->state);
+    const struct gough_som_info *som = getSomInfo(q->state);
     assert(q_cur_type(q) == MQE_START);
     DEBUG_PRINTF("state %hu\n", s);
     assert(s);
diff --git a/src/nfa/goughcompile.cpp b/src/nfa/goughcompile.cpp
index 62cdf72c..98031617 100644
--- a/src/nfa/goughcompile.cpp
+++ b/src/nfa/goughcompile.cpp
@@ -444,7 +444,7 @@ static
 void copy_propagate_report_set(vector<pair<ReportID, GoughSSAVar *> > &rep) {
     vector<pair<ReportID, GoughSSAVar *> >::iterator it = rep.begin();
     while (it != rep.end()) {
-        GoughSSAVar *var = it->second;
+        const GoughSSAVar *var = it->second;
         if (!var) {
             ++it;
             continue;
@@ -546,7 +546,7 @@ void remove_dead(GoughGraph &g) {
     }
 
     while (!queue.empty()) {
-        GoughSSAVar *v = queue.back();
+        const GoughSSAVar *v = queue.back();
         queue.pop_back();
         for (GoughSSAVar *var : v->get_inputs()) {
             if (var->seen) {
diff --git a/src/nfa/goughcompile_reg.cpp b/src/nfa/goughcompile_reg.cpp
index 4798a9c3..60e32f12 100644
--- a/src/nfa/goughcompile_reg.cpp
+++ b/src/nfa/goughcompile_reg.cpp
@@ -194,7 +194,7 @@ void handle_pending_vars(GoughSSAVar *def, const GoughGraph &g,
         if (contains(aux.containing_v, var)) {
             /* def is used by join vertex, value only needs to be live on some
              * incoming edges */
-            GoughSSAVarJoin *vj = (GoughSSAVarJoin *)var;
+            const GoughSSAVarJoin *vj = (GoughSSAVarJoin *)var;
             const flat_set<GoughEdge> &live_edges
                 = vj->get_edges_for_input(def);
             for (const auto &e : live_edges) {
diff --git a/src/nfa/limex_compile.cpp b/src/nfa/limex_compile.cpp
index 2ec65552..14fad352 100644
--- a/src/nfa/limex_compile.cpp
+++ b/src/nfa/limex_compile.cpp
@@ -290,7 +290,7 @@ void maskSetBits(Mask &m, const NFAStateSet &bits) {
 
 template<class Mask>
 bool isMaskZero(Mask &m) {
-    u8 *m8 = (u8 *)&m;
+    const u8 *m8 = (u8 *)&m;
     for (u32 i = 0; i < sizeof(m); i++) {
         if (m8[i]) {
             return false;
@@ -1700,7 +1700,7 @@ struct Factory {
     static
     void allocState(NFA *nfa, u32 repeatscratchStateSize,
                     u32 repeatStreamState) {
-        implNFA_t *limex = (implNFA_t *)getMutableImplNfa(nfa);
+        const implNFA_t *limex = (implNFA_t *)getMutableImplNfa(nfa);
 
         // LimEx NFAs now store the following in state:
         // 1. state bitvector (always present)
diff --git a/src/nfa/limex_runtime_impl.h b/src/nfa/limex_runtime_impl.h
index 7b89182b..d21739d6 100644
--- a/src/nfa/limex_runtime_impl.h
+++ b/src/nfa/limex_runtime_impl.h
@@ -984,9 +984,9 @@ char JOIN(LIMEX_API_ROOT, _inAccept)(const struct NFA *nfa,
     assert(q->state && q->streamState);
 
     const IMPL_NFA_T *limex = getImplNfa(nfa);
-    union RepeatControl *repeat_ctrl =
+    const union RepeatControl *repeat_ctrl =
         getRepeatControlBase(q->state, sizeof(STATE_T));
-    char *repeat_state = q->streamState + limex->stateSize;
+    const char *repeat_state = q->streamState + limex->stateSize;
     STATE_T state = *(STATE_T *)q->state;
     u64a offset = q->offset + q_last_loc(q) + 1;
 
@@ -999,9 +999,9 @@ char JOIN(LIMEX_API_ROOT, _inAnyAccept)(const struct NFA *nfa, struct mq *q) {
     assert(q->state && q->streamState);
 
     const IMPL_NFA_T *limex = getImplNfa(nfa);
-    union RepeatControl *repeat_ctrl =
+    const union RepeatControl *repeat_ctrl =
         getRepeatControlBase(q->state, sizeof(STATE_T));
-    char *repeat_state = q->streamState + limex->stateSize;
+    const char *repeat_state = q->streamState + limex->stateSize;
     STATE_T state = *(STATE_T *)q->state;
     u64a offset = q->offset + q_last_loc(q) + 1;
 
@@ -1020,9 +1020,9 @@ enum nfa_zombie_status JOIN(LIMEX_API_ROOT, _zombie_status)(
 
     if (limex->repeatCount) {
         u64a offset = q->offset + loc + 1;
-        union RepeatControl *repeat_ctrl =
+        const union RepeatControl *repeat_ctrl =
             getRepeatControlBase(q->state, sizeof(STATE_T));
-        char *repeat_state = q->streamState + limex->stateSize;
+        const char *repeat_state = q->streamState + limex->stateSize;
         SQUASH_UNTUG_BR_FN(limex, repeat_ctrl, repeat_state, offset, &state);
     }
 
diff --git a/src/nfa/mcclellancompile.cpp b/src/nfa/mcclellancompile.cpp
index d0e30573..463cb46c 100644
--- a/src/nfa/mcclellancompile.cpp
+++ b/src/nfa/mcclellancompile.cpp
@@ -176,7 +176,7 @@ static
 mstate_aux *getAux(NFA *n, dstate_id_t i) {
     assert(isMcClellanType(n->type));
 
-    mcclellan *m = (mcclellan *)getMutableImplNfa(n);
+    const mcclellan *m = (mcclellan *)getMutableImplNfa(n);
     mstate_aux *aux_base = (mstate_aux *)((char *)n + m->aux_offset);
 
     mstate_aux *aux = aux_base + i;
@@ -202,7 +202,7 @@ void markEdges(NFA *n, u16 *succ_table, const dfa_info &info) {
                 continue;
             }
 
-            mstate_aux *aux = getAux(n, succ_table[c_prime]);
+            const mstate_aux *aux = getAux(n, succ_table[c_prime]);
 
             if (aux->accept) {
                 succ_table[c_prime] |= ACCEPT_FLAG;
@@ -231,7 +231,7 @@ void markEdges(NFA *n, u16 *succ_table, const dfa_info &info) {
                 continue;
             }
 
-            mstate_aux *aux = getAux(n, succ_i);
+            const mstate_aux *aux = getAux(n, succ_i);
 
             if (aux->accept) {
                 succ_i |= ACCEPT_FLAG;
@@ -261,7 +261,7 @@ void markEdges(NFA *n, u16 *succ_table, const dfa_info &info) {
             // check successful transition
             u16 next = unaligned_load_u16((u8 *)trans);
             if (next < wide_limit) {
-                mstate_aux *aux = getAux(n, next);
+                const mstate_aux *aux = getAux(n, next);
                 if (aux->accept) {
                     next |= ACCEPT_FLAG;
                 }
@@ -278,7 +278,7 @@ void markEdges(NFA *n, u16 *succ_table, const dfa_info &info) {
                 if (next_k >= wide_limit) {
                     continue;
                 }
-                mstate_aux *aux_k = getAux(n, next_k);
+                const mstate_aux *aux_k = getAux(n, next_k);
                 if (aux_k->accept) {
                     next_k |= ACCEPT_FLAG;
                 }
diff --git a/src/nfa/mcsheng_compile.cpp b/src/nfa/mcsheng_compile.cpp
index 81db7024..8e2f2d11 100644
--- a/src/nfa/mcsheng_compile.cpp
+++ b/src/nfa/mcsheng_compile.cpp
@@ -144,7 +144,7 @@ u8 dfa_info::getAlphaShift() const {
 
 static
 mstate_aux *getAux(NFA *n, dstate_id_t i) {
-    mcsheng *m = (mcsheng *)getMutableImplNfa(n);
+    const mcsheng *m = (mcsheng *)getMutableImplNfa(n);
     mstate_aux *aux_base = (mstate_aux *)((char *)n + m->aux_offset);
 
     mstate_aux *aux = aux_base + i;
@@ -244,7 +244,7 @@ void populateBasicInfo(size_t state_size, const dfa_info &info,
 
 static
 mstate_aux *getAux64(NFA *n, dstate_id_t i) {
-    mcsheng64 *m = (mcsheng64 *)getMutableImplNfa(n);
+    const mcsheng64 *m = (mcsheng64 *)getMutableImplNfa(n);
     mstate_aux *aux_base = (mstate_aux *)((char *)n + m->aux_offset);
 
     mstate_aux *aux = aux_base + i;
@@ -674,7 +674,7 @@ void fill_in_aux_info(NFA *nfa, const dfa_info &info,
 
 static
 u16 get_edge_flags(NFA *nfa, dstate_id_t target_impl_id) {
-    mstate_aux *aux = getAux(nfa, target_impl_id);
+    const mstate_aux *aux = getAux(nfa, target_impl_id);
     u16 flags = 0;
 
     if (aux->accept) {
@@ -748,7 +748,7 @@ void fill_in_aux_info64(NFA *nfa, const dfa_info &info,
 
 static
 u16 get_edge_flags64(NFA *nfa, dstate_id_t target_impl_id) {
-    mstate_aux *aux = getAux64(nfa, target_impl_id);
+    const mstate_aux *aux = getAux64(nfa, target_impl_id);
     u16 flags = 0;
 
     if (aux->accept) {
diff --git a/src/nfa/mpv.c b/src/nfa/mpv.c
index edfe5f89..f84e9af1 100644
--- a/src/nfa/mpv.c
+++ b/src/nfa/mpv.c
@@ -1074,7 +1074,7 @@ s64a nfaExecMpv_QueueExecRaw(const struct NFA *nfa, struct mq *q, s64a end) {
         return 0;
     } else {
         const struct mpv *m = getImplNfa(nfa);
-        u8 *reporters = (u8 *)q->state + m->reporter_offset;
+        const u8 *reporters = (u8 *)q->state + m->reporter_offset;
 
         if (mmbit_any_precise(reporters, m->kilo_count)) {
             DEBUG_PRINTF("next byte\n");
@@ -1087,7 +1087,7 @@ s64a nfaExecMpv_QueueExecRaw(const struct NFA *nfa, struct mq *q, s64a end) {
                 next_event = q->items[q->cur].location;
             }
 
-            struct mpv_decomp_state *s = (struct mpv_decomp_state *)q->state;
+            const struct mpv_decomp_state *s = (struct mpv_decomp_state *)q->state;
             struct mpv_pq_item *pq
                 = (struct mpv_pq_item *)(q->state + m->pq_offset);
             if (s->pq_size) {
diff --git a/src/nfa/nfa_api_queue.h b/src/nfa/nfa_api_queue.h
index e3579a7e..16a4c011 100644
--- a/src/nfa/nfa_api_queue.h
+++ b/src/nfa/nfa_api_queue.h
@@ -167,7 +167,7 @@ void pushQueueNoMerge(struct mq * restrict q, u32 e, s64a loc) {
     // We assert that the event is different from its predecessor. If it's a
     // dupe, you should have used the ordinary pushQueue call.
     if (q->end) {
-        UNUSED struct mq_item *prev = &q->items[q->end - 1];
+        UNUSED const struct mq_item *prev = &q->items[q->end - 1];
         assert(prev->type != e || prev->location != loc);
     }
 #endif
diff --git a/src/nfa/nfa_api_util.h b/src/nfa/nfa_api_util.h
index affc5f38..1af9c801 100644
--- a/src/nfa/nfa_api_util.h
+++ b/src/nfa/nfa_api_util.h
@@ -68,7 +68,7 @@ void pushQueueAt(struct mq * restrict q, u32 pos, u32 e, s64a loc) {
     // We assert that the event is different from its predecessor. If it's a
     // dupe, you should have used the ordinary pushQueue call.
     if (q->end) {
-        UNUSED struct mq_item *prev = &q->items[q->end - 1];
+        UNUSED const struct mq_item *prev = &q->items[q->end - 1];
         assert(prev->type != e || prev->location != loc);
     }
 #endif
diff --git a/src/nfagraph/ng_som.cpp b/src/nfagraph/ng_som.cpp
index fcc5bf1b..bbe14124 100644
--- a/src/nfagraph/ng_som.cpp
+++ b/src/nfagraph/ng_som.cpp
@@ -1408,7 +1408,7 @@ bool doSomPlanning(NGHolder &g, bool stuck_in,
 
     /* Need to verify how far the lock covers */
     u32 bad_region;
-    NGHolder *ap_pref = plan.back().prefix.get();
+    const NGHolder *ap_pref = plan.back().prefix.get();
     NGHolder ap_temp;
     if (hasBigCycles(*ap_pref)) {
         fillRoughMidfix(&ap_temp, g, regions, info, picked);
diff --git a/src/nfagraph/ng_violet.cpp b/src/nfagraph/ng_violet.cpp
index 525d2f14..14bdf73f 100644
--- a/src/nfagraph/ng_violet.cpp
+++ b/src/nfagraph/ng_violet.cpp
@@ -1791,7 +1791,7 @@ void removeRedundantLiteralsFromInfixes(RoseInGraph &g,
     }
 
     for (const auto &m : infixes) {
-        NGHolder *h = m.first;
+        const NGHolder *h = m.first;
         const auto &edges = m.second;
         removeRedundantLiteralsFromInfix(*h, g, edges, cc);
     }
diff --git a/src/parser/ComponentAlternation.cpp b/src/parser/ComponentAlternation.cpp
index c4bad672..a3374907 100644
--- a/src/parser/ComponentAlternation.cpp
+++ b/src/parser/ComponentAlternation.cpp
@@ -73,7 +73,7 @@ Component *ComponentAlternation::accept(ComponentVisitor &v) {
     }
 
     for (auto i = children.begin(), e = children.end(); i != e; ++i) {
-        Component *child = i->get();
+        const Component *child = i->get();
         c = (*i)->accept(v);
         if (c != child) {
             // Child has been replaced (new Component pointer) or we've been
diff --git a/src/parser/ComponentAssertion.cpp b/src/parser/ComponentAssertion.cpp
index cadff932..a2b4c24c 100644
--- a/src/parser/ComponentAssertion.cpp
+++ b/src/parser/ComponentAssertion.cpp
@@ -59,7 +59,7 @@ Component * ComponentAssertion::accept(ComponentVisitor &v) {
     }
 
     for (auto i = children.begin(), e = children.end(); i != e; ++i) {
-        Component *child = i->get();
+        const Component *child = i->get();
         c = (*i)->accept(v);
         if (c != child) {
             // Child has been replaced (new Component pointer) or we've been
diff --git a/src/parser/ComponentAtomicGroup.cpp b/src/parser/ComponentAtomicGroup.cpp
index 106f24fc..3630021f 100644
--- a/src/parser/ComponentAtomicGroup.cpp
+++ b/src/parser/ComponentAtomicGroup.cpp
@@ -51,7 +51,7 @@ Component *ComponentAtomicGroup::accept(ComponentVisitor &v) {
     }
 
     for (auto i = children.begin(), e = children.end(); i != e; ++i) {
-        Component *child = i->get();
+        const Component *child = i->get();
         c = (*i)->accept(v);
         if (c != child) {
             // Child has been replaced (new Component pointer) or we've been
diff --git a/src/parser/ComponentCondReference.cpp b/src/parser/ComponentCondReference.cpp
index b6ff44db..cfd2a38d 100644
--- a/src/parser/ComponentCondReference.cpp
+++ b/src/parser/ComponentCondReference.cpp
@@ -79,7 +79,7 @@ Component *ComponentCondReference::accept(ComponentVisitor &v) {
     }
 
     if (kind == CONDITION_ASSERTION) {
-        Component *a = assertion.get();
+        const Component *a = assertion.get();
         c = assertion->accept(v);
         if (c != a) {
             assertion.reset(c);
@@ -87,7 +87,7 @@ Component *ComponentCondReference::accept(ComponentVisitor &v) {
     }
 
     for (auto i = children.begin(), e = children.end(); i != e; ++i) {
-        Component *child = i->get();
+        const Component *child = i->get();
         c = (*i)->accept(v);
         if (c != child) {
             // Child has been replaced (new Component pointer) or we've been
diff --git a/src/parser/ComponentSequence.cpp b/src/parser/ComponentSequence.cpp
index f5200206..c67a277b 100644
--- a/src/parser/ComponentSequence.cpp
+++ b/src/parser/ComponentSequence.cpp
@@ -82,7 +82,7 @@ Component *ComponentSequence::accept(ComponentVisitor &v) {
     }
 
     for (auto i = children.begin(), e = children.end(); i != e; ++i) {
-        Component *child = i->get();
+        const Component *child = i->get();
         c = (*i)->accept(v);
         if (c != child) {
             // Child has been replaced (new Component pointer) or we've been
diff --git a/src/rose/block.c b/src/rose/block.c
index b3f424cb..60572d49 100644
--- a/src/rose/block.c
+++ b/src/rose/block.c
@@ -227,7 +227,7 @@ int roseBlockFloating(const struct RoseEngine *t, struct hs_scratch *scratch) {
 
     const size_t length = scratch->core_info.len;
     char *state = scratch->core_info.state;
-    struct RoseContext *tctxt = &scratch->tctxt;
+    const struct RoseContext *tctxt = &scratch->tctxt;
 
     DEBUG_PRINTF("ftable fd=%u fmd %u\n", t->floatingDistance,
                  t->floatingMinDistance);
@@ -377,7 +377,7 @@ void roseBlockExec(const struct RoseEngine *t, struct hs_scratch *scratch) {
 
     init_for_block(t, scratch, state, is_small_block);
 
-    struct RoseContext *tctxt = &scratch->tctxt;
+    const struct RoseContext *tctxt = &scratch->tctxt;
 
     if (is_small_block) {
         const void *sbtable = getSBLiteralMatcher(t);
diff --git a/src/rose/catchup.c b/src/rose/catchup.c
index 7a6648da..ad0636b8 100644
--- a/src/rose/catchup.c
+++ b/src/rose/catchup.c
@@ -679,7 +679,7 @@ hwlmcb_rv_t buildSufPQ(const struct RoseEngine *t, char *state, s64a safe_loc,
                        s64a final_loc, struct hs_scratch *scratch) {
     assert(scratch->catchup_pq.qm_size <= t->outfixEndQueue);
 
-    struct RoseContext *tctxt = &scratch->tctxt;
+    const struct RoseContext *tctxt = &scratch->tctxt;
     assert(t->activeArrayCount);
 
     assert(scratch->core_info.buf_offset + final_loc
diff --git a/src/rose/match.c b/src/rose/match.c
index 84d3b1fd..643b1d9f 100644
--- a/src/rose/match.c
+++ b/src/rose/match.c
@@ -68,7 +68,7 @@ void printMatch(const struct core_info *ci, u64a start, u64a end) {
 
 hwlmcb_rv_t roseDelayRebuildCallback(size_t end, u32 id,
                                      struct hs_scratch *scratch) {
-    struct RoseContext *tctx = &scratch->tctxt;
+    const struct RoseContext *tctx = &scratch->tctxt;
     struct core_info *ci = &scratch->core_info;
     const struct RoseEngine *t = ci->rose;
     size_t rb_len = MIN(ci->hlen, t->delayRebuildLength);
@@ -296,7 +296,7 @@ hwlmcb_rv_t flushAnchoredLiteralAtLoc(const struct RoseEngine *t,
                                       struct hs_scratch *scratch,
                                       u32 curr_loc) {
     struct RoseContext *tctxt = &scratch->tctxt;
-    struct fatbit *curr_row = getAnchoredLiteralLog(scratch)[curr_loc - 1];
+    const struct fatbit *curr_row = getAnchoredLiteralLog(scratch)[curr_loc - 1];
     u32 region_width = t->anchored_count;
 
     const u32 *programs = getByOffset(t, t->anchoredProgramOffset);
@@ -334,7 +334,7 @@ hwlmcb_rv_t flushAnchoredLiteralAtLoc(const struct RoseEngine *t,
 
 static really_inline
 u32 anchored_it_begin(struct hs_scratch *scratch) {
-    struct RoseContext *tctxt = &scratch->tctxt;
+    const struct RoseContext *tctxt = &scratch->tctxt;
     if (tctxt->lastEndOffset >= scratch->anchored_literal_region_len) {
         return MMB_INVALID;
     }
diff --git a/src/rose/match.h b/src/rose/match.h
index c03b1ebb..5a4bfa6b 100644
--- a/src/rose/match.h
+++ b/src/rose/match.h
@@ -254,8 +254,8 @@ void roseFlushLastByteHistory(const struct RoseEngine *t,
         return;
     }
 
-    struct RoseContext *tctxt = &scratch->tctxt;
-    struct core_info *ci = &scratch->core_info;
+    const struct RoseContext *tctxt = &scratch->tctxt;
+    const struct core_info *ci = &scratch->core_info;
 
     /* currEnd is last byte of string + 1 */
     if (tctxt->lastEndOffset == ci->buf_offset + ci->len
diff --git a/src/rose/rose_build_anchored.cpp b/src/rose/rose_build_anchored.cpp
index 027aefd0..88128a8d 100644
--- a/src/rose/rose_build_anchored.cpp
+++ b/src/rose/rose_build_anchored.cpp
@@ -896,7 +896,7 @@ buildAnchoredMatcher(RoseBuildImpl &build, const vector<LitFragment> &fragments,
     for (size_t i = 0; i < nfas.size(); i++) {
         const NFA *nfa = nfas[i].get();
         anchored_matcher_info *ami = (anchored_matcher_info *)curr;
-        char *prev_curr = curr;
+        const char *prev_curr = curr;
 
         curr += sizeof(anchored_matcher_info);
 
diff --git a/src/rose/rose_build_merge.cpp b/src/rose/rose_build_merge.cpp
index 343cd308..1172728b 100644
--- a/src/rose/rose_build_merge.cpp
+++ b/src/rose/rose_build_merge.cpp
@@ -1186,8 +1186,8 @@ bool mergeLeftVL_tryMergeCandidate(RoseBuildImpl &build, left_id &r1,
 
     assert(!r1.graph() == !r2.graph());
     if (r1.graph()) {
-        NGHolder *h1 = r1.graph();
-        NGHolder *h2 = r2.graph();
+        const NGHolder *h1 = r1.graph();
+        const NGHolder *h2 = r2.graph();
         CharReach stop1 = findStopAlphabet(*h1, SOM_NONE);
         CharReach stop2 = findStopAlphabet(*h2, SOM_NONE);
         CharReach stopboth = stop1 & stop2;
diff --git a/src/rose/stream.c b/src/rose/stream.c
index acf4855a..94da8717 100644
--- a/src/rose/stream.c
+++ b/src/rose/stream.c
@@ -382,7 +382,7 @@ void roseSaveNfaStreamState(const struct RoseEngine *t, char *state,
          qi = mmbit_iterate(aa, aaCount, qi)) {
         DEBUG_PRINTF("saving stream state for qi=%u\n", qi);
 
-        struct mq *q = queues + qi;
+        const struct mq *q = queues + qi;
 
         // If it's active, it should have an active queue (as we should have
         // done some work!)
@@ -517,7 +517,7 @@ void runEagerPrefixesStream(const struct RoseEngine *t,
 static really_inline
 int can_never_match(const struct RoseEngine *t, char *state,
                     struct hs_scratch *scratch, size_t length, u64a offset) {
-    struct RoseContext *tctxt = &scratch->tctxt;
+    const struct RoseContext *tctxt = &scratch->tctxt;
 
     if (tctxt->groups) {
         DEBUG_PRINTF("still has active groups\n");
diff --git a/src/rose/stream_long_lit.h b/src/rose/stream_long_lit.h
index df9b57f4..68adc136 100644
--- a/src/rose/stream_long_lit.h
+++ b/src/rose/stream_long_lit.h
@@ -332,7 +332,7 @@ void storeLongLiteralState(const struct RoseEngine *t, char *state,
         return;
     }
 
-    struct core_info *ci = &scratch->core_info;
+    const struct core_info *ci = &scratch->core_info;
     const struct RoseLongLitTable *ll_table =
         getByOffset(t, t->longLitTableOffset);
     assert(ll_table->maxLen);
diff --git a/src/som/som_runtime.c b/src/som/som_runtime.c
index ce179ca0..3544309c 100644
--- a/src/som/som_runtime.c
+++ b/src/som/som_runtime.c
@@ -512,7 +512,7 @@ int flushStoredSomMatches_i(struct hs_scratch *scratch, u64a offset) {
     /* fire any reports from the logs and clear them */
     if (offset == scratch->deduper.current_report_offset + 1) {
         struct fatbit *done_log = scratch->deduper.som_log[offset % 2];
-        u64a *done_starts = scratch->deduper.som_start_log[offset % 2];
+        const u64a *done_starts = scratch->deduper.som_start_log[offset % 2];
 
         halt = clearSomLog(scratch, scratch->deduper.current_report_offset - 1,
                            done_log, done_starts);
@@ -522,9 +522,9 @@ int flushStoredSomMatches_i(struct hs_scratch *scratch, u64a offset) {
         u64a f_offset = scratch->deduper.current_report_offset - 1;
         u64a s_offset = scratch->deduper.current_report_offset;
         struct fatbit *first_log = scratch->deduper.som_log[f_offset % 2];
-        u64a *first_starts = scratch->deduper.som_start_log[f_offset % 2];
+        const u64a *first_starts = scratch->deduper.som_start_log[f_offset % 2];
         struct fatbit *second_log = scratch->deduper.som_log[s_offset % 2];
-        u64a *second_starts = scratch->deduper.som_start_log[s_offset % 2];
+        const u64a *second_starts = scratch->deduper.som_start_log[s_offset % 2];
 
         halt = clearSomLog(scratch, f_offset, first_log, first_starts) ||
                clearSomLog(scratch, s_offset, second_log, second_starts);
diff --git a/src/som/som_stream.c b/src/som/som_stream.c
index 93ab709e..6502d87c 100644
--- a/src/som/som_stream.c
+++ b/src/som/som_stream.c
@@ -102,7 +102,7 @@ void storeSomToStream(struct hs_scratch *scratch, const u64a offset) {
     const u32 som_store_count = rose->somLocationCount;
     assert(som_store_count); // Caller should ensure that we have work to do.
 
-    u8 *som_store_valid = (u8 *)ci->state + rose->stateOffsets.somValid;
+    const u8 *som_store_valid = (u8 *)ci->state + rose->stateOffsets.somValid;
     char *stream_som_store = ci->state + rose->stateOffsets.somLocation;
     const u64a *som_store = scratch->som_store;
     const u8 som_size = rose->somHorizon;
diff --git a/src/util/multibit.h b/src/util/multibit.h
index 95261b37..3ec45d6f 100644
--- a/src/util/multibit.h
+++ b/src/util/multibit.h
@@ -1421,7 +1421,7 @@ uplevel:
             if (level == 0) {
                 return; // we are done
             }
-            u8 *block_ptr =
+            const u8 *block_ptr =
                 mmbit_get_level_root(bits, level) + key * sizeof(MMB_TYPE);
             MMB_TYPE real_block = mmb_load(block_ptr);
             key >>= MMB_KEY_SHIFT;
diff --git a/src/util/multibit_compress.h b/src/util/multibit_compress.h
index e7b4fd8e..018bfec2 100644
--- a/src/util/multibit_compress.h
+++ b/src/util/multibit_compress.h
@@ -167,7 +167,7 @@ char mmbit_decompress(u8 *bits, u32 total_bits, const u8 *comp,
     comp += sizeof(MMB_TYPE);
     while (1) {
         if (key_rem < MMB_KEY_BITS) {
-            u8 *block_ptr = mmbit_get_level_root(bits, level) +
+            const u8 *block_ptr = mmbit_get_level_root(bits, level) +
                             key * sizeof(MMB_TYPE);
             MMB_TYPE block = mmb_load(block_ptr);
             MMB_TYPE block_1 = block & ~mmb_mask_zero_to_nocheck(key_rem);
diff --git a/unit/internal/shufti.cpp b/unit/internal/shufti.cpp
index fb8d58a8..a3955267 100644
--- a/unit/internal/shufti.cpp
+++ b/unit/internal/shufti.cpp
@@ -79,8 +79,8 @@ TEST(Shufti, BuildMask2) {
     int ret = shuftiBuildMasks(chars, (u8 *)&lomask, (u8 *)&himask);
     ASSERT_NE(-1, ret);
 
-    u8 *lo = (u8 *)&lomask;
-    u8 *hi = (u8 *)&himask;
+    const u8 *lo = (u8 *)&lomask;
+    const u8 *hi = (u8 *)&himask;
     ASSERT_TRUE(lo['a' % 16] & hi['a' >> 4]);
     ASSERT_TRUE(lo['B' % 16] & hi['B' >> 4]);
     ASSERT_FALSE(lo['a' % 16] & hi['B' >> 4]);
@@ -100,8 +100,8 @@ TEST(Shufti, BuildMask4) {
     int ret = shuftiBuildMasks(chars, (u8 *)&lomask, (u8 *)&himask);
     ASSERT_NE(-1, ret);
 
-    u8 *lo = (u8 *)&lomask;
-    u8 *hi = (u8 *)&himask;
+    const u8 *lo = (u8 *)&lomask;
+    const u8 *hi = (u8 *)&himask;
     ASSERT_TRUE(lo['a' % 16] & hi['a' >> 4]);
     ASSERT_TRUE(lo['A' % 16] & hi['A' >> 4]);
     ASSERT_TRUE(lo['b' % 16] & hi['b' >> 4]);
@@ -331,10 +331,10 @@ TEST(DoubleShufti, BuildMask2) {
                                      (u8 *)&lo2m, (u8 *)&hi2m);
     ASSERT_TRUE(ret);
 
-    u8 *lo1 = (u8 *)&lo1m;
-    u8 *lo2 = (u8 *)&lo2m;
-    u8 *hi1 = (u8 *)&hi1m;
-    u8 *hi2 = (u8 *)&hi2m;
+    const u8 *lo1 = (u8 *)&lo1m;
+    const u8 *lo2 = (u8 *)&lo2m;
+    const u8 *hi1 = (u8 *)&hi1m;
+    const u8 *hi2 = (u8 *)&hi2m;
     ASSERT_NE(0xff,
               lo1['a' % 16] | hi1['a' >> 4] | lo2['z' % 16] | hi2['z' >> 4]);
     ASSERT_NE(0xff,
@@ -359,10 +359,10 @@ TEST(DoubleShufti, BuildMask4) {
                                      (u8 *)&lo2m, (u8 *)&hi2m);
     ASSERT_TRUE(ret);
 
-    u8 *lo1 = (u8 *)&lo1m;
-    u8 *lo2 = (u8 *)&lo2m;
-    u8 *hi1 = (u8 *)&hi1m;
-    u8 *hi2 = (u8 *)&hi2m;
+    const u8 *lo1 = (u8 *)&lo1m;
+    const u8 *lo2 = (u8 *)&lo2m;
+    const u8 *hi1 = (u8 *)&hi1m;
+    const u8 *hi2 = (u8 *)&hi2m;
     ASSERT_NE(0xff,
               lo1['a' % 16] | hi1['a' >> 4] | lo2['z' % 16] | hi2['z' >> 4]);
     ASSERT_NE(0xff,
@@ -388,10 +388,10 @@ TEST(DoubleShufti, BuildMask5) {
                                      (u8 *)&lo2m, (u8 *)&hi2m);
     ASSERT_TRUE(ret);
 
-    u8 *lo1 = (u8 *)&lo1m;
-    u8 *lo2 = (u8 *)&lo2m;
-    u8 *hi1 = (u8 *)&hi1m;
-    u8 *hi2 = (u8 *)&hi2m;
+    const u8 *lo1 = (u8 *)&lo1m;
+    const u8 *lo2 = (u8 *)&lo2m;
+    const u8 *hi1 = (u8 *)&hi1m;
+    const u8 *hi2 = (u8 *)&hi2m;
     ASSERT_NE(0xff,
               lo1['a' % 16] | hi1['a' >> 4] | lo2['z' % 16] | hi2['z' >> 4]);
     ASSERT_EQ(0xff,
@@ -426,10 +426,10 @@ TEST(DoubleShufti, BuildMask6) {
                                      (u8 *)&lo2m, (u8 *)&hi2m);
     ASSERT_TRUE(ret);
 
-    u8 *lo1 = (u8 *)&lo1m;
-    u8 *lo2 = (u8 *)&lo2m;
-    u8 *hi1 = (u8 *)&hi1m;
-    u8 *hi2 = (u8 *)&hi2m;
+    const u8 *lo1 = (u8 *)&lo1m;
+    const u8 *lo2 = (u8 *)&lo2m;
+    const u8 *hi1 = (u8 *)&hi1m;
+    const u8 *hi2 = (u8 *)&hi2m;
     ASSERT_NE(0xff,
               lo1['a' % 16] | hi1['a' >> 4] | lo2['z' % 16] | hi2['z' >> 4]);
     ASSERT_NE(0xff,