diff --git a/openbsd-compat/port-aix.c b/openbsd-compat/port-aix.c
index e1ad3f117..e0d3eba51 100644
--- a/openbsd-compat/port-aix.c
+++ b/openbsd-compat/port-aix.c
@@ -383,12 +383,13 @@ aix_restoreauthdb(void)
 
 # ifdef USE_AIX_KRB_NAME
 /*
- * aix_krb5_get_principal_name: returns the user's kerberos client principal name if
- * configured, otherwise NULL.  Caller must free returned string.
+ * aix_krb5_get_principal_name: returns the user's kerberos client principal
+ * name if configured, otherwise NULL.  Caller must free returned string.
  */
 char *
-aix_krb5_get_principal_name(char *pw_name)
+aix_krb5_get_principal_name(const char *const_pw_name)
 {
+	char *pw_name = (char *)const_pw_name;
 	char *authname = NULL, *authdomain = NULL, *principal = NULL;
 
 	setuserdb(S_READ);
@@ -398,7 +399,8 @@ aix_krb5_get_principal_name(char *pw_name)
 		debug("AIX getuserattr S_AUTHNAME: %s", strerror(errno));
 
 	if (authdomain != NULL)
-		xasprintf(&principal, "%s@%s", authname ? authname : pw_name, authdomain);
+		xasprintf(&principal, "%s@%s", authname ? authname : pw_name,
+		    authdomain);
 	else if (authname != NULL)
 		principal = xstrdup(authname);
 	enduserdb();
diff --git a/openbsd-compat/port-aix.h b/openbsd-compat/port-aix.h
index 904de3096..0ee366140 100644
--- a/openbsd-compat/port-aix.h
+++ b/openbsd-compat/port-aix.h
@@ -97,7 +97,7 @@ char *sys_auth_get_lastlogin_msg(const char *, uid_t);
 # define CUSTOM_FAILED_LOGIN 1
 # if defined(S_AUTHDOMAIN)  && defined (S_AUTHNAME)
 # define USE_AIX_KRB_NAME
-char *aix_krb5_get_principal_name(char *);
+char *aix_krb5_get_principal_name(const char *);
 # endif
 #endif