diff --git a/src/basic/cgroup-util.c b/src/basic/cgroup-util.c
index dcc0ffdf44..fc28109db8 100644
--- a/src/basic/cgroup-util.c
+++ b/src/basic/cgroup-util.c
@@ -2871,7 +2871,7 @@ bool fd_is_cgroup_fs(int fd) {
         return is_cgroup_fs(&s);
 }
 
-static const char *cgroup_controller_table[_CGROUP_CONTROLLER_MAX] = {
+static const char *const cgroup_controller_table[_CGROUP_CONTROLLER_MAX] = {
         [CGROUP_CONTROLLER_CPU] = "cpu",
         [CGROUP_CONTROLLER_CPUACCT] = "cpuacct",
         [CGROUP_CONTROLLER_IO] = "io",
diff --git a/src/core/manager.c b/src/core/manager.c
index 33785d905f..7f4f71b9e9 100644
--- a/src/core/manager.c
+++ b/src/core/manager.c
@@ -3787,7 +3787,7 @@ static bool generator_path_any(const char* const* paths) {
         return found;
 }
 
-static const char* system_env_generator_binary_paths[] = {
+static const char *const system_env_generator_binary_paths[] = {
         "/run/systemd/system-environment-generators",
         "/etc/systemd/system-environment-generators",
         "/usr/local/lib/systemd/system-environment-generators",
@@ -3795,7 +3795,7 @@ static const char* system_env_generator_binary_paths[] = {
         NULL
 };
 
-static const char* user_env_generator_binary_paths[] = {
+static const char *const user_env_generator_binary_paths[] = {
         "/run/systemd/user-environment-generators",
         "/etc/systemd/user-environment-generators",
         "/usr/local/lib/systemd/user-environment-generators",
@@ -3805,7 +3805,7 @@ static const char* user_env_generator_binary_paths[] = {
 
 static int manager_run_environment_generators(Manager *m) {
         char **tmp = NULL; /* this is only used in the forked process, no cleanup here */
-        const char **paths;
+        const char *const *paths;
         void* args[] = {
                 [STDOUT_GENERATE] = &tmp,
                 [STDOUT_COLLECT] = &tmp,
diff --git a/src/core/unit.c b/src/core/unit.c
index d559cfca12..2d7cb1457c 100644
--- a/src/core/unit.c
+++ b/src/core/unit.c
@@ -3195,7 +3195,7 @@ static int serialize_cgroup_mask(FILE *f, const char *key, CGroupMask mask) {
         return serialize_item(f, key, s);
 }
 
-static const char *ip_accounting_metric_field[_CGROUP_IP_ACCOUNTING_METRIC_MAX] = {
+static const char *const ip_accounting_metric_field[_CGROUP_IP_ACCOUNTING_METRIC_MAX] = {
         [CGROUP_IP_INGRESS_BYTES] = "ip-accounting-ingress-bytes",
         [CGROUP_IP_INGRESS_PACKETS] = "ip-accounting-ingress-packets",
         [CGROUP_IP_EGRESS_BYTES] = "ip-accounting-egress-bytes",
diff --git a/src/network/netdev/bond.c b/src/network/netdev/bond.c
index 57f82a8f10..7d912ae5a7 100644
--- a/src/network/netdev/bond.c
+++ b/src/network/netdev/bond.c
@@ -116,7 +116,7 @@ static const char *const bond_arp_all_targets_table[_NETDEV_BOND_ARP_ALL_TARGETS
 DEFINE_STRING_TABLE_LOOKUP(bond_arp_all_targets, BondArpAllTargets);
 DEFINE_CONFIG_PARSE_ENUM(config_parse_bond_arp_all_targets, bond_arp_all_targets, BondArpAllTargets, "Failed to parse bond Arp all targets");
 
-static const char *bond_primary_reselect_table[_NETDEV_BOND_PRIMARY_RESELECT_MAX] = {
+static const char *const bond_primary_reselect_table[_NETDEV_BOND_PRIMARY_RESELECT_MAX] = {
         [NETDEV_BOND_PRIMARY_RESELECT_ALWAYS] = "always",
         [NETDEV_BOND_PRIMARY_RESELECT_BETTER]= "better",
         [NETDEV_BOND_PRIMARY_RESELECT_FAILURE]= "failure",
diff --git a/src/shared/install.c b/src/shared/install.c
index 9a9d4bfa21..75b6aace0a 100644
--- a/src/shared/install.c
+++ b/src/shared/install.c
@@ -117,7 +117,7 @@ bool unit_type_may_template(UnitType type) {
                       UNIT_PATH);
 }
 
-static const char *unit_file_type_table[_UNIT_FILE_TYPE_MAX] = {
+static const char *const unit_file_type_table[_UNIT_FILE_TYPE_MAX] = {
         [UNIT_FILE_TYPE_REGULAR] = "regular",
         [UNIT_FILE_TYPE_SYMLINK] = "symlink",
         [UNIT_FILE_TYPE_MASKED] = "masked",
diff --git a/src/test/test-path-util.c b/src/test/test-path-util.c
index c64ca7b016..182991695a 100644
--- a/src/test/test-path-util.c
+++ b/src/test/test-path-util.c
@@ -179,7 +179,14 @@ static void test_find_binary(const char *self) {
 }
 
 static void test_prefixes(void) {
-        static const char* values[] = { "/a/b/c/d", "/a/b/c", "/a/b", "/a", "", NULL};
+        static const char* const values[] = {
+                "/a/b/c/d",
+                "/a/b/c",
+                "/a/b",
+                "/a",
+                "",
+                NULL
+        };
         unsigned i;
         char s[PATH_MAX];
         bool b;
diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c
index ad73600241..96b619f8cc 100644
--- a/src/tmpfiles/tmpfiles.c
+++ b/src/tmpfiles/tmpfiles.c
@@ -1504,7 +1504,7 @@ typedef enum {
         _CREATION_MODE_INVALID = -1
 } CreationMode;
 
-static const char *creation_mode_verb_table[_CREATION_MODE_MAX] = {
+static const char *const creation_mode_verb_table[_CREATION_MODE_MAX] = {
         [CREATION_NORMAL] = "Created",
         [CREATION_EXISTING] = "Found existing",
         [CREATION_FORCE] = "Created replacement",
diff --git a/src/udev/cdrom_id/cdrom_id.c b/src/udev/cdrom_id/cdrom_id.c
index 214fbaa042..3f882f557b 100644
--- a/src/udev/cdrom_id/cdrom_id.c
+++ b/src/udev/cdrom_id/cdrom_id.c
@@ -585,7 +585,7 @@ out:
 static int cd_media_info(int fd) {
         struct scsi_cmd sc;
         unsigned char header[32];
-        static const char *media_status[] = {
+        static const char *const media_status[] = {
                 "blank",
                 "appendable",
                 "complete",
diff --git a/src/udev/udev-builtin.c b/src/udev/udev-builtin.c
index 48ce295a46..7bbfd143f6 100644
--- a/src/udev/udev-builtin.c
+++ b/src/udev/udev-builtin.c
@@ -12,7 +12,7 @@
 
 static bool initialized;
 
-static const struct udev_builtin *builtins[_UDEV_BUILTIN_MAX] = {
+static const struct udev_builtin *const builtins[_UDEV_BUILTIN_MAX] = {
 #if HAVE_BLKID
         [UDEV_BUILTIN_BLKID] = &udev_builtin_blkid,
 #endif
diff --git a/src/udev/udev-rules.c b/src/udev/udev-rules.c
index 835ce17165..c5d6feee7e 100644
--- a/src/udev/udev-rules.c
+++ b/src/udev/udev-rules.c
@@ -219,7 +219,7 @@ struct rule_tmp {
 
 #if ENABLE_DEBUG_UDEV
 static const char *operation_str(enum operation_type type) {
-        static const char *operation_strs[] = {
+        static const char *const operation_strs[] = {
                 [OP_UNSET] =            "UNSET",
                 [OP_MATCH] =            "match",
                 [OP_NOMATCH] =          "nomatch",
@@ -235,7 +235,7 @@ static const char *operation_str(enum operation_type type) {
 }
 
 static const char *string_glob_str(enum string_glob_type type) {
-        static const char *string_glob_strs[] = {
+        static const char *const string_glob_strs[] = {
                 [GL_UNSET] =            "UNSET",
                 [GL_PLAIN] =            "plain",
                 [GL_GLOB] =             "glob",
@@ -248,7 +248,7 @@ static const char *string_glob_str(enum string_glob_type type) {
 }
 
 static const char *token_str(enum token_type type) {
-        static const char *token_strs[] = {
+        static const char *const token_strs[] = {
                 [TK_UNSET] =                    "UNSET",
                 [TK_RULE] =                     "RULE",
 
diff --git a/src/udev/udevadm.c b/src/udev/udevadm.c
index 28194314de..e6dbb111a9 100644
--- a/src/udev/udevadm.c
+++ b/src/udev/udevadm.c
@@ -16,7 +16,7 @@
 #include "util.h"
 
 static int help(void) {
-        static const char * short_descriptions[][2] = {
+        static const char *const short_descriptions[][2] = {
                 { "info",         "Query sysfs or the udev database" },
                 { "trigger",      "Request events from the kernel"   },
                 { "settle",       "Wait for pending udev events"     },