diff --git a/callback.c b/callback.c
index 076d7b4d..ea647af4 100644
--- a/callback.c
+++ b/callback.c
@@ -14,10 +14,10 @@ struct callback {
     void *ctx;
 };
 
-struct callback *cbcurr = NULL, *cbhead = NULL, *cbtail = NULL;
+static struct callback *cbcurr = NULL, *cbhead = NULL, *cbtail = NULL;
 
-toplevel_callback_notify_fn_t notify_frontend = NULL;
-void *notify_ctx = NULL;
+static toplevel_callback_notify_fn_t notify_frontend = NULL;
+static void *notify_ctx = NULL;
 
 void request_callback_notifications(toplevel_callback_notify_fn_t fn,
                                     void *ctx)
diff --git a/minibidi.c b/minibidi.c
index 39b66618..91af7947 100644
--- a/minibidi.c
+++ b/minibidi.c
@@ -102,7 +102,7 @@ typedef struct {
 #define SHAPE_FIRST 0x621
 #define SHAPE_LAST (SHAPE_FIRST + lenof(shapetypes) - 1)
 
-const shape_node shapetypes[] = {
+static const shape_node shapetypes[] = {
     /* index, Typ, Iso, Ligature Index*/
     /* 621 */ {SU, 0xFE80},
     /* 622 */ {SR, 0xFE81},
diff --git a/mpint.c b/mpint.c
index 20bc6661..cfd011be 100644
--- a/mpint.c
+++ b/mpint.c
@@ -878,7 +878,7 @@ unsigned mp_eq_integer(mp_int *x, uintmax_t n)
     return 1 ^ normalise_to_1(diff);   /* return 1 if diff _is_ zero */
 }
 
-void mp_neg_into(mp_int *r, mp_int *a)
+static void mp_neg_into(mp_int *r, mp_int *a)
 {
     mp_int zero;
     zero.nw = 0;
diff --git a/portfwd.c b/portfwd.c
index c910e539..5bd4aacf 100644
--- a/portfwd.c
+++ b/portfwd.c
@@ -732,7 +732,7 @@ static int pfr_cmp(void *av, void *bv)
     return 0;
 }
 
-void pfr_free(PortFwdRecord *pfr)
+static void pfr_free(PortFwdRecord *pfr)
 {
     /* Dispose of any listening socket. */
     if (pfr->local)
diff --git a/ssh.c b/ssh.c
index e9fafdc3..69590d5c 100644
--- a/ssh.c
+++ b/ssh.c
@@ -557,7 +557,7 @@ void ssh_user_close(Ssh *ssh, const char *fmt, ...)
     }
 }
 
-void ssh_deferred_abort_callback(void *vctx)
+static void ssh_deferred_abort_callback(void *vctx)
 {
     Ssh *ssh = (Ssh *)vctx;
     char *msg = ssh->deferred_abort_message;
diff --git a/sshaes.c b/sshaes.c
index a04ea588..233fc6b3 100644
--- a/sshaes.c
+++ b/sshaes.c
@@ -123,7 +123,7 @@ struct aes_extra {
         pid, 16, bits, bits/8, flags, name HW_NAME_SUFFIX,              \
         NULL, NULL };                                                   \
                                                                         \
-    const struct aes_extra extra_##cid = {                              \
+    static const struct aes_extra extra_##cid = {                       \
         &ssh_##cid##_sw, &ssh_##cid##_hw };                             \
                                                                         \
     const ssh_cipheralg ssh_##cid = {                                   \
diff --git a/sshcrcda.c b/sshcrcda.c
index 33dedadd..18044754 100644
--- a/sshcrcda.c
+++ b/sshcrcda.c
@@ -44,8 +44,8 @@
 
 #define CMP(a, b)       (memcmp(a, b, SSH_BLOCKSIZE))
 
-uint8_t ONE[4] = { 1, 0, 0, 0 };
-uint8_t ZERO[4] = { 0, 0, 0, 0 };
+static const uint8_t ONE[4] = { 1, 0, 0, 0 };
+static const uint8_t ZERO[4] = { 0, 0, 0, 0 };
 
 struct crcda_ctx {
     uint16_t *h;
diff --git a/sshdes.c b/sshdes.c
index 8d4b9399..4dcecf77 100644
--- a/sshdes.c
+++ b/sshdes.c
@@ -430,7 +430,7 @@ static inline uint64_t bitsel(
     return ret;
 }
 
-void des_key_setup(uint64_t key, des_keysched *sched)
+static void des_key_setup(uint64_t key, des_keysched *sched)
 {
     static const int8_t PC1[] = {
          7, 15, 23, 31, 39, 47, 55, 63,  6, 14, 22, 30, 38, 46,
diff --git a/sshecc.c b/sshecc.c
index 3005e288..1e047c64 100644
--- a/sshecc.c
+++ b/sshecc.c
@@ -1124,7 +1124,7 @@ static void eddsa_sign(ssh_key *key, ptrlen data,
     mp_free(s);
 }
 
-const struct ecsign_extra sign_extra_ed25519 = {
+static const struct ecsign_extra sign_extra_ed25519 = {
     ec_ed25519, &ssh_sha512,
     NULL, 0,
 };
@@ -1154,7 +1154,7 @@ const ssh_keyalg ssh_ecdsa_ed25519 = {
 static const unsigned char nistp256_oid[] = {
     0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07
 };
-const struct ecsign_extra sign_extra_nistp256 = {
+static const struct ecsign_extra sign_extra_nistp256 = {
     ec_p256, &ssh_sha256,
     nistp256_oid, lenof(nistp256_oid),
 };
@@ -1184,7 +1184,7 @@ const ssh_keyalg ssh_ecdsa_nistp256 = {
 static const unsigned char nistp384_oid[] = {
     0x2b, 0x81, 0x04, 0x00, 0x22
 };
-const struct ecsign_extra sign_extra_nistp384 = {
+static const struct ecsign_extra sign_extra_nistp384 = {
     ec_p384, &ssh_sha384,
     nistp384_oid, lenof(nistp384_oid),
 };
@@ -1214,7 +1214,7 @@ const ssh_keyalg ssh_ecdsa_nistp384 = {
 static const unsigned char nistp521_oid[] = {
     0x2b, 0x81, 0x04, 0x00, 0x23
 };
-const struct ecsign_extra sign_extra_nistp521 = {
+static const struct ecsign_extra sign_extra_nistp521 = {
     ec_p521, &ssh_sha512,
     nistp521_oid, lenof(nistp521_oid),
 };
@@ -1449,7 +1449,7 @@ const ssh_kex ssh_ec_kex_curve25519 = {
     &ssh_sha256, &kex_extra_curve25519,
 };
 
-const struct eckex_extra kex_extra_nistp256 = {
+static const struct eckex_extra kex_extra_nistp256 = {
     ec_p256,
     ssh_ecdhkex_w_setup,
     ssh_ecdhkex_w_cleanup,
@@ -1461,7 +1461,7 @@ const ssh_kex ssh_ec_kex_nistp256 = {
     &ssh_sha256, &kex_extra_nistp256,
 };
 
-const struct eckex_extra kex_extra_nistp384 = {
+static const struct eckex_extra kex_extra_nistp384 = {
     ec_p384,
     ssh_ecdhkex_w_setup,
     ssh_ecdhkex_w_cleanup,
@@ -1473,7 +1473,7 @@ const ssh_kex ssh_ec_kex_nistp384 = {
     &ssh_sha384, &kex_extra_nistp384,
 };
 
-const struct eckex_extra kex_extra_nistp521 = {
+static const struct eckex_extra kex_extra_nistp521 = {
     ec_p521,
     ssh_ecdhkex_w_setup,
     ssh_ecdhkex_w_cleanup,
diff --git a/sshhmac.c b/sshhmac.c
index 1dfc4b96..85c5b6bb 100644
--- a/sshhmac.c
+++ b/sshhmac.c
@@ -160,7 +160,7 @@ static const char *hmac_text_name(ssh2_mac *mac)
     return ctx->text_name->s;
 }
 
-const struct hmac_extra ssh_hmac_sha256_extra = { &ssh_sha256, "" };
+static const struct hmac_extra ssh_hmac_sha256_extra = { &ssh_sha256, "" };
 const ssh2_macalg ssh_hmac_sha256 = {
     hmac_new, hmac_free, hmac_key,
     hmac_start, hmac_genresult, hmac_text_name,
@@ -168,7 +168,7 @@ const ssh2_macalg ssh_hmac_sha256 = {
     32, 32, &ssh_hmac_sha256_extra,
 };
 
-const struct hmac_extra ssh_hmac_md5_extra = { &ssh_md5, "" };
+static const struct hmac_extra ssh_hmac_md5_extra = { &ssh_md5, "" };
 const ssh2_macalg ssh_hmac_md5 = {
     hmac_new, hmac_free, hmac_key,
     hmac_start, hmac_genresult, hmac_text_name,
@@ -176,7 +176,7 @@ const ssh2_macalg ssh_hmac_md5 = {
     16, 16, &ssh_hmac_md5_extra,
 };
 
-const struct hmac_extra ssh_hmac_sha1_extra = { &ssh_sha1, "" };
+static const struct hmac_extra ssh_hmac_sha1_extra = { &ssh_sha1, "" };
 
 const ssh2_macalg ssh_hmac_sha1 = {
     hmac_new, hmac_free, hmac_key,
@@ -185,7 +185,7 @@ const ssh2_macalg ssh_hmac_sha1 = {
     20, 20, &ssh_hmac_sha1_extra,
 };
 
-const struct hmac_extra ssh_hmac_sha1_96_extra = { &ssh_sha1, "-96" };
+static const struct hmac_extra ssh_hmac_sha1_96_extra = { &ssh_sha1, "-96" };
 
 const ssh2_macalg ssh_hmac_sha1_96 = {
     hmac_new, hmac_free, hmac_key,
@@ -194,7 +194,7 @@ const ssh2_macalg ssh_hmac_sha1_96 = {
     12, 20, &ssh_hmac_sha1_96_extra,
 };
 
-const struct hmac_extra ssh_hmac_sha1_buggy_extra = {
+static const struct hmac_extra ssh_hmac_sha1_buggy_extra = {
     &ssh_sha1, "", "bug-compatible"
 };
 
@@ -205,7 +205,7 @@ const ssh2_macalg ssh_hmac_sha1_buggy = {
     20, 16, &ssh_hmac_sha1_buggy_extra,
 };
 
-const struct hmac_extra ssh_hmac_sha1_96_buggy_extra = {
+static const struct hmac_extra ssh_hmac_sha1_96_buggy_extra = {
     &ssh_sha1, "-96", "bug-compatible"
 };
 
diff --git a/sshmd5.c b/sshmd5.c
index 79ca39e9..833c745d 100644
--- a/sshmd5.c
+++ b/sshmd5.c
@@ -130,7 +130,7 @@ static void MD5_Block(MD5_Core_State *s, uint32_t *block)
 
 static void MD5_BinarySink_write(BinarySink *bs, const void *data, size_t len);
 
-void MD5Init(struct MD5Context *s)
+static void MD5Init(struct MD5Context *s)
 {
     MD5_Core_Init(&s->core);
     s->blkused = 0;
@@ -183,7 +183,7 @@ static void MD5_BinarySink_write(BinarySink *bs, const void *data, size_t len)
     }
 }
 
-void MD5Final(unsigned char output[16], struct MD5Context *s)
+static void MD5Final(unsigned char output[16], struct MD5Context *s)
 {
     int i;
     unsigned pad;
diff --git a/sshrsa.c b/sshrsa.c
index 2ca72342..4634763f 100644
--- a/sshrsa.c
+++ b/sshrsa.c
@@ -128,8 +128,8 @@ bool rsa_ssh1_encrypt(unsigned char *data, int length, RSAKey *key)
  * Uses Chinese Remainder Theorem to speed computation up over the
  * obvious implementation of a single big modpow.
  */
-mp_int *crt_modpow(mp_int *base, mp_int *exp, mp_int *mod,
-                      mp_int *p, mp_int *q, mp_int *iqmp)
+static mp_int *crt_modpow(mp_int *base, mp_int *exp, mp_int *mod,
+                          mp_int *p, mp_int *q, mp_int *iqmp)
 {
     mp_int *pm1, *qm1, *pexp, *qexp, *presult, *qresult;
     mp_int *diff, *multiplier, *ret0, *ret;
@@ -780,7 +780,7 @@ static void rsa2_sign(ssh_key *key, ptrlen data,
     mp_free(out);
 }
 
-char *rsa2_invalid(ssh_key *key, unsigned flags)
+static char *rsa2_invalid(ssh_key *key, unsigned flags)
 {
     RSAKey *rsa = container_of(key, RSAKey, sshk);
     size_t bits = mp_get_nbits(rsa->modulus), nbytes = (bits + 7) / 8;
diff --git a/sshsh512.c b/sshsh512.c
index b5af140a..3ea54a35 100644
--- a/sshsh512.c
+++ b/sshsh512.c
@@ -193,14 +193,14 @@ static void SHA512_Block(SHA512_State *s, uint64_t *block) {
 static void SHA512_BinarySink_write(BinarySink *bs,
                                     const void *p, size_t len);
 
-void SHA512_Init(SHA512_State *s) {
+static void SHA512_Init(SHA512_State *s) {
     SHA512_Core_Init(s);
     s->blkused = 0;
     s->lenhi = s->lenlo = 0;
     BinarySink_INIT(s, SHA512_BinarySink_write);
 }
 
-void SHA384_Init(SHA512_State *s) {
+static void SHA384_Init(SHA512_State *s) {
     SHA384_Core_Init(s);
     s->blkused = 0;
     s->lenhi = s->lenlo = 0;
@@ -246,7 +246,7 @@ static void SHA512_BinarySink_write(BinarySink *bs,
     }
 }
 
-void SHA512_Final(SHA512_State *s, unsigned char *digest) {
+static void SHA512_Final(SHA512_State *s, unsigned char *digest) {
     int i;
     int pad;
     unsigned char c[BLKSIZE];
@@ -271,7 +271,7 @@ void SHA512_Final(SHA512_State *s, unsigned char *digest) {
         PUT_64BIT_MSB_FIRST(digest + i*8, s->h[i]);
 }
 
-void SHA384_Final(SHA512_State *s, unsigned char *digest) {
+static void SHA384_Final(SHA512_State *s, unsigned char *digest) {
     unsigned char biggerDigest[512 / 8];
     SHA512_Final(s, biggerDigest);
     memcpy(digest, biggerDigest, 384 / 8);
diff --git a/terminal.c b/terminal.c
index 08592568..125847d7 100644
--- a/terminal.c
+++ b/terminal.c
@@ -55,12 +55,12 @@
 
 #define has_compat(x) ( ((CL_##x)&term->compatibility_level) != 0 )
 
-const char *EMPTY_WINDOW_TITLE = "";
+static const char *const EMPTY_WINDOW_TITLE = "";
 
-const char sco2ansicolour[] = { 0, 4, 2, 6, 1, 5, 3, 7 };
+static const char sco2ansicolour[] = { 0, 4, 2, 6, 1, 5, 3, 7 };
 
 #define sel_nl_sz  (sizeof(sel_nl)/sizeof(wchar_t))
-const wchar_t sel_nl[] = SEL_NL;
+static const wchar_t sel_nl[] = SEL_NL;
 
 /*
  * Fetch the character at a particular position in a line array,
diff --git a/testcrypt.c b/testcrypt.c
index 10481167..417f091e 100644
--- a/testcrypt.c
+++ b/testcrypt.c
@@ -99,7 +99,7 @@ enum ValueType {
 
 typedef enum ValueType ValueType;
 
-const char *const type_names[] = {
+static const char *const type_names[] = {
 #define VALTYPE_NAME(n,t,f) #n,
     VALUE_TYPES(VALTYPE_NAME)
 #undef VALTYPE_NAME
@@ -384,7 +384,7 @@ struct finaliser {
 };
 
 static struct finaliser *finalisers;
-size_t nfinalisers, finalisersize;
+static size_t nfinalisers, finalisersize;
 
 static void add_finaliser(finaliser_fn_t fn, void *ctx)
 {
diff --git a/unix/gtkdlg.c b/unix/gtkdlg.c
index 27b1e55c..3574e1db 100644
--- a/unix/gtkdlg.c
+++ b/unix/gtkdlg.c
@@ -3279,14 +3279,14 @@ static void messagebox_handler(union control *ctrl, dlgparam *dp,
         dlg_end(dp, ctrl->generic.context.i);
 }
 
-const struct message_box_button button_array_yn[] = {
+static const struct message_box_button button_array_yn[] = {
     {"Yes", 'y', +1, 1},
     {"No", 'n', -1, 0},
 };
 const struct message_box_buttons buttons_yn = {
     button_array_yn, lenof(button_array_yn),
 };
-const struct message_box_button button_array_ok[] = {
+static const struct message_box_button button_array_ok[] = {
     {"OK", 'o', 1, 1},
 };
 const struct message_box_buttons buttons_ok = {
diff --git a/unix/uxpgnt.c b/unix/uxpgnt.c
index ab7acf0c..d5eca2e6 100644
--- a/unix/uxpgnt.c
+++ b/unix/uxpgnt.c
@@ -45,7 +45,7 @@ static void uxpgnt_log(PageantListenerClient *plc, const char *fmt, va_list ap)
     fprintf(pageant_logfp, "\n");
 }
 
-const PageantListenerClientVtable uxpgnt_vtable = {
+static const PageantListenerClientVtable uxpgnt_vtable = {
     uxpgnt_log,
 };
 
diff --git a/unix/x11misc.c b/unix/x11misc.c
index 813773c2..e1fd1906 100644
--- a/unix/x11misc.c
+++ b/unix/x11misc.c
@@ -32,9 +32,8 @@ struct x11_err_to_ignore {
     unsigned long serial;
 };
 
-struct x11_err_to_ignore *errs;
-
-size_t nerrs, errsize;
+static struct x11_err_to_ignore *errs;
+static size_t nerrs, errsize;
 
 static int x11_error_handler(Display *thisdisp, XErrorEvent *err)
 {
diff --git a/windows/winpgnt.c b/windows/winpgnt.c
index a4c69c02..67f53c00 100644
--- a/windows/winpgnt.c
+++ b/windows/winpgnt.c
@@ -1188,7 +1188,7 @@ int flags = FLAG_SYNCAGENT;
 struct winpgnt_client {
     PageantListenerClient plc;
 };
-const PageantListenerClientVtable winpgnt_vtable = {
+static const PageantListenerClientVtable winpgnt_vtable = {
     NULL, /* no logging */
 };
 
diff --git a/windows/winpgntc.c b/windows/winpgntc.c
index 2bd2f154..d9ca7b46 100644
--- a/windows/winpgntc.c
+++ b/windows/winpgntc.c
@@ -210,7 +210,7 @@ static size_t named_pipe_agent_gotdata(
     return 0;
 }
 
-agent_pending_query *named_pipe_agent_query(
+static agent_pending_query *named_pipe_agent_query(
     strbuf *query, void **out, int *outlen,
     void (*callback)(void *, void *, int), void *callback_ctx)
 {
diff --git a/windows/winsecur.c b/windows/winsecur.c
index 3926e33a..38929e0c 100644
--- a/windows/winsecur.c
+++ b/windows/winsecur.c
@@ -92,7 +92,7 @@ PSID get_user_sid(void)
     return ret;
 }
 
-bool getsids(char **error)
+static bool getsids(char **error)
 {
 #ifdef __clang__
 #pragma clang diagnostic push