diff --git a/src/app-layer-ftp.c b/src/app-layer-ftp.c
index 5fafbb36c107..e049c2df4b94 100644
--- a/src/app-layer-ftp.c
+++ b/src/app-layer-ftp.c
@@ -274,7 +274,7 @@ static AppLayerResult FTPGetLineForDirection(
     if (input->len <= 0)
         return APP_LAYER_ERROR;
 
-    uint8_t *lf_idx = memchr(input->buf + input->consumed, 0x0a, input->len);
+    const uint8_t *lf_idx = memchr(input->buf + input->consumed, 0x0a, input->len);
 
     if (lf_idx == NULL) {
         if (!(*current_line_truncated) && (uint32_t)input->len >= ftp_max_line_len) {
@@ -1375,7 +1375,7 @@ uint16_t JsonGetNextLineFromBuffer(const char *buffer, const uint16_t len)
         return UINT16_MAX;
     }
 
-    char *c = strchr(buffer, '\n');
+    const char *c = strchr(buffer, '\n');
     return c == NULL ? len : (uint16_t)(c - buffer + 1);
 }
 
diff --git a/src/app-layer-smtp.c b/src/app-layer-smtp.c
index a7b76ec44290..b3f2827166cc 100644
--- a/src/app-layer-smtp.c
+++ b/src/app-layer-smtp.c
@@ -555,7 +555,7 @@ static AppLayerResult SMTPGetLine(Flow *f, StreamSlice *slice, SMTPState *state,
     }
     SCLogDebug("frame %p", frame);
 
-    uint8_t *lf_idx = memchr(input->buf + input->consumed, 0x0a, input->len);
+    const uint8_t *lf_idx = memchr(input->buf + input->consumed, 0x0a, input->len);
     bool discard_till_lf = (direction == 0) ? state->discard_till_lf_ts : state->discard_till_lf_tc;
 
     if (lf_idx == NULL) {
diff --git a/src/conf-yaml-loader.c b/src/conf-yaml-loader.c
index d1ca162e6446..553fcf5a8273 100644
--- a/src/conf-yaml-loader.c
+++ b/src/conf-yaml-loader.c
@@ -82,7 +82,7 @@ Mangle(char *string)
 static void
 ConfYamlSetConfDirname(const char *filename)
 {
-    char *ep;
+    const char *ep;
 
     ep = strrchr(filename, '\\');
     if (ep == NULL)
diff --git a/src/datasets.c b/src/datasets.c
index 9517915e845f..9d6586d61c81 100644
--- a/src/datasets.c
+++ b/src/datasets.c
@@ -156,7 +156,7 @@ static int DatasetLoadIPv4(Dataset *set)
 int DatasetParseIpv6String(Dataset *set, const char *line, struct in6_addr *in6)
 {
     /* Checking IPv6 case */
-    char *got_colon = strchr(line, ':');
+    const char *got_colon = strchr(line, ':');
     if (got_colon) {
         uint32_t ip6addr[4];
         if (inet_pton(AF_INET6, line, in6) != 1) {
diff --git a/src/decode.c b/src/decode.c
index 01394fef475f..9aa5b16757a3 100644
--- a/src/decode.c
+++ b/src/decode.c
@@ -743,7 +743,7 @@ void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
             }
 
             char name[256];
-            char *dot = strchr(DEvents[i].event_name, '.');
+            const char *dot = strchr(DEvents[i].event_name, '.');
             BUG_ON(!dot);
             snprintf(name, sizeof(name), "%s.%s",
                     stats_decoder_events_prefix, dot+1);
diff --git a/src/detect-app-layer-protocol.c b/src/detect-app-layer-protocol.c
index 46c825496075..fab270ae6ff6 100644
--- a/src/detect-app-layer-protocol.c
+++ b/src/detect-app-layer-protocol.c
@@ -157,7 +157,7 @@ static DetectAppLayerProtocolData *DetectAppLayerProtocolParse(const char *arg,
     AppProto alproto = ALPROTO_UNKNOWN;
 
     char alproto_copy[MAX_ALPROTO_NAME];
-    char *sep = strchr(arg, ',');
+    const char *sep = strchr(arg, ',');
     char *alproto_name;
     if (sep && sep - arg < MAX_ALPROTO_NAME) {
         strlcpy(alproto_copy, arg, sep - arg + 1);
diff --git a/src/detect-pcre.c b/src/detect-pcre.c
index bd2487778269..1aaec6d35dfa 100644
--- a/src/detect-pcre.c
+++ b/src/detect-pcre.c
@@ -416,9 +416,9 @@ static DetectPcreData *DetectPcreParse (DetectEngineCtx *de_ctx,
     bool apply_match_limit = false;
 
     int cut_capture = 0;
-    char *fcap = strstr(regexstr, "flow:");
-    char *pcap = strstr(regexstr, "pkt:");
-    char *acap = strstr(regexstr, "alert:");
+    const char *fcap = strstr(regexstr, "flow:");
+    const char *pcap = strstr(regexstr, "pkt:");
+    const char *acap = strstr(regexstr, "alert:");
     /* take the size of the whole input as buffer size for the regex we will
      * extract below. Add 1 to please Coverity's alloc_strlen test. */
     size_t slen = strlen(regexstr) + 1;
diff --git a/src/util-logopenfile.c b/src/util-logopenfile.c
index 52170113a0db..6c75bd860234 100644
--- a/src/util-logopenfile.c
+++ b/src/util-logopenfile.c
@@ -818,7 +818,7 @@ static bool LogFileThreadedName(
     }
 
     /* Check if basename has an extension */
-    char *dot = strrchr(base, '.');
+    const char *dot = strrchr(base, '.');
     if (dot) {
         char *tname = SCStrdup(original_name);
         if (!tname) {
diff --git a/src/util-magic.c b/src/util-magic.c
index 68fd2cbf8c64..232d6da868bc 100644
--- a/src/util-magic.c
+++ b/src/util-magic.c
@@ -433,7 +433,7 @@ static int MagicDetectTest07(void)
     result = MagicThreadLookup(&ctx, buffer, buffer_len);
     FAIL_IF_NULL(result);
 
-    char *str = strstr(result, "OpenDocument Text");
+    const char *str = strstr(result, "OpenDocument Text");
     FAIL_IF_NULL(str);
 
     MagicDeinitContext(ctx);
diff --git a/src/util-path.c b/src/util-path.c
index cde5a67ff3d7..8c6932d5dc92 100644
--- a/src/util-path.c
+++ b/src/util-path.c
@@ -251,7 +251,7 @@ const char *SCBasename(const char *path)
     if (!path || strlen(path) == 0)
         return NULL;
 
-    char *final = strrchr(path, DIRECTORY_SEPARATOR);
+    const char *final = strrchr(path, DIRECTORY_SEPARATOR);
     if (!final)
         return path;