diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index 7954238..dcc2336 100644
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -2058,7 +2058,7 @@
 
 __owur int tls_get_ticket_from_client(SSL *s, CLIENTHELLO_MSG *hello,
                                       SSL_SESSION **ret);
-__owur int tls_check_client_ems_support(SSL *s, CLIENTHELLO_MSG *hello);
+__owur int tls_check_client_ems_support(SSL *s, const CLIENTHELLO_MSG *hello);
 
 __owur int tls12_get_sigandhash(WPACKET *pkt, const EVP_PKEY *pk,
                                 const EVP_MD *md);
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index 100c9f9..6598776 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -1701,7 +1701,7 @@
  * Sadly we cannot differentiate 10.6, 10.7 and 10.8.4 (which work), from
  * 10.8..10.8.3 (which don't work).
  */
-static void ssl_check_for_safari(SSL *s, CLIENTHELLO_MSG *hello)
+static void ssl_check_for_safari(SSL *s, const CLIENTHELLO_MSG *hello)
 {
     unsigned int type;
     PACKET sni, tmppkt;
@@ -2905,7 +2905,7 @@
  *  1 on success
  *  0 on error
  */
-int tls_check_client_ems_support(SSL *s, CLIENTHELLO_MSG *hello)
+int tls_check_client_ems_support(SSL *s, const CLIENTHELLO_MSG *hello)
 {
     RAW_EXTENSION *emsext;