diff --git a/src/bogo_shim/bogo_shim.cpp b/src/bogo_shim/bogo_shim.cpp
index 029eac8a515..dbf07453555 100644
--- a/src/bogo_shim/bogo_shim.cpp
+++ b/src/bogo_shim/bogo_shim.cpp
@@ -1512,7 +1512,7 @@ class Shim_Callbacks final : public Botan::TLS::Callbacks {
          }
 
          if(!cert_chain.empty() && cert_chain.front().is_self_signed()) {
-            for(const auto roots : trusted_roots) {
+            for(auto* const roots : trusted_roots) {
                if(roots->certificate_known(cert_chain.front())) {
                   shim_log("Trusting self-signed certificate");
                   return;
diff --git a/src/cli/tls_utils.cpp b/src/cli/tls_utils.cpp
index 2703c800f0b..e483a511241 100644
--- a/src/cli/tls_utils.cpp
+++ b/src/cli/tls_utils.cpp
@@ -126,11 +126,11 @@ class TLS_Client_Hello_Reader final : public Command {
          const auto* hello_base =
             std::visit([](const auto& ch) -> const Botan::TLS::Client_Hello* { return &ch; }, hello);
 
-         const auto version = std::visit(Botan::overloaded{
-                                            [](const Botan::TLS::Client_Hello_12&) { return "1.2"; },
-                                            [](const Botan::TLS::Client_Hello_13&) { return "1.3"; },
-                                         },
-                                         hello);
+         const std::string version = std::visit(Botan::overloaded{
+                                                   [](const Botan::TLS::Client_Hello_12&) { return "1.2"; },
+                                                   [](const Botan::TLS::Client_Hello_13&) { return "1.3"; },
+                                                },
+                                                hello);
 
          oss << "Version: " << version << "\n"
              << "Random: " << Botan::hex_encode(hello_base->random()) << "\n";
@@ -165,7 +165,7 @@ class TLS_Client_Hello_Reader final : public Command {
             oss << "\n";
          }
 
-         if(auto sg = hello_base->extensions().get<Botan::TLS::Supported_Groups>()) {
+         if(auto* sg = hello_base->extensions().get<Botan::TLS::Supported_Groups>()) {
             oss << "Supported Groups: ";
             for(const auto group : sg->groups()) {
                oss << group.to_string().value_or(Botan::fmt("Unknown group: {}", group.wire_code())) << " ";
@@ -183,7 +183,7 @@ class TLS_Client_Hello_Reader final : public Command {
                           hello_flags["Session Ticket"] = ch12.supports_session_ticket();
                        },
                        [&](const Botan::TLS::Client_Hello_13& ch13) {
-                          if(auto ks = ch13.extensions().get<Botan::TLS::Key_Share>()) {
+                          if(auto* ks = ch13.extensions().get<Botan::TLS::Key_Share>()) {
                              oss << "Key Shares: ";
                              for(const auto group : ks->offered_groups()) {
                                 oss << group.to_string().value_or(Botan::fmt("Unknown group: {}", group.wire_code()))
diff --git a/src/examples/tls_ssl_key_log_file.cpp b/src/examples/tls_ssl_key_log_file.cpp
index 2239f760f84..d276174ea15 100644
--- a/src/examples/tls_ssl_key_log_file.cpp
+++ b/src/examples/tls_ssl_key_log_file.cpp
@@ -79,7 +79,7 @@ class Server_Credential : public Botan::Credentials_Manager {
          std::vector<Botan::X509_Certificate> certs;
          for(auto& cert : certificates) {
             std::string algorithm = cert.subject_public_key()->algo_name();
-            for(auto& key : cert_key_types) {
+            for(const auto& key : cert_key_types) {
                if(algorithm == key) {
                   certs.push_back(cert);
                }
diff --git a/src/examples/tls_stream_client.cpp b/src/examples/tls_stream_client.cpp
index 9c33f90602b..29f2f7f27e7 100644
--- a/src/examples/tls_stream_client.cpp
+++ b/src/examples/tls_stream_client.cpp
@@ -107,9 +107,9 @@ int main(int argc, char* argv[]) {
       return 1;
    }
 
-   const auto host = argv[1];
-   const auto port = argv[2];
-   const auto target = argv[3];
+   auto* const host = argv[1];
+   auto* const port = argv[2];
+   auto* const target = argv[3];
 
    try {
       boost::asio::io_context io_context;
diff --git a/src/fuzzer/mem_pool.cpp b/src/fuzzer/mem_pool.cpp
index c05c5e1007d..45ed6b058aa 100644
--- a/src/fuzzer/mem_pool.cpp
+++ b/src/fuzzer/mem_pool.cpp
@@ -88,7 +88,7 @@ void fuzz(std::span<const uint8_t> in) {
    std::map<uint8_t*, size_t> ptrs;
 
    size_t in_len = in.size();
-   auto x = in.data();
+   const auto* x = in.data();
    while(in_len > 0) {
       const uint8_t op = in[0] % 2;
       size_t idx = (in[0] >> 1);
diff --git a/src/lib/prov/tpm2/tpm2_context.cpp b/src/lib/prov/tpm2/tpm2_context.cpp
index 27cf0f65b42..1ff48a5e48d 100644
--- a/src/lib/prov/tpm2/tpm2_context.cpp
+++ b/src/lib/prov/tpm2/tpm2_context.cpp
@@ -53,11 +53,9 @@ bool Context::supports_botan_crypto_backend() noexcept {
 }
 
 std::shared_ptr<Context> Context::create(const std::string& tcti_nameconf) {
-   const auto nameconf_ptr = tcti_nameconf.c_str();
-
    TSS2_TCTI_CONTEXT* tcti_ctx = nullptr;
    ESYS_CONTEXT* esys_ctx = nullptr;
-   check_rc("TCTI Initialization", Tss2_TctiLdr_Initialize(nameconf_ptr, &tcti_ctx));
+   check_rc("TCTI Initialization", Tss2_TctiLdr_Initialize(tcti_nameconf.c_str(), &tcti_ctx));
    BOTAN_ASSERT_NONNULL(tcti_ctx);
    check_rc("TPM2 Initialization", Esys_Initialize(&esys_ctx, tcti_ctx, nullptr /* ABI version */));
    BOTAN_ASSERT_NONNULL(esys_ctx);
@@ -67,8 +65,8 @@ std::shared_ptr<Context> Context::create(const std::string& tcti_nameconf) {
 }
 
 std::shared_ptr<Context> Context::create(std::optional<std::string> tcti, std::optional<std::string> conf) {
-   const auto tcti_ptr = tcti.has_value() ? tcti->c_str() : nullptr;
-   const auto conf_ptr = conf.has_value() ? conf->c_str() : nullptr;
+   const char* const tcti_ptr = tcti.has_value() ? tcti->c_str() : nullptr;
+   const char* const conf_ptr = conf.has_value() ? conf->c_str() : nullptr;
 
    TSS2_TCTI_CONTEXT* tcti_ctx = nullptr;
    ESYS_CONTEXT* esys_ctx = nullptr;
diff --git a/src/lib/prov/tpm2/tpm2_crypto_backend/tpm2_crypto_backend_impl.cpp b/src/lib/prov/tpm2/tpm2_crypto_backend/tpm2_crypto_backend_impl.cpp
index ec0f0b95d71..b0d2f52e9d5 100644
--- a/src/lib/prov/tpm2/tpm2_crypto_backend/tpm2_crypto_backend_impl.cpp
+++ b/src/lib/prov/tpm2/tpm2_crypto_backend/tpm2_crypto_backend_impl.cpp
@@ -94,7 +94,7 @@ template <typename T>
       return std::nullopt;
    }
 
-   auto ccs = reinterpret_cast<Botan::TPM2::CryptoCallbackState*>(userdata);
+   auto* ccs = reinterpret_cast<Botan::TPM2::CryptoCallbackState*>(userdata);
    if(!ccs) {
       return std::nullopt;
    }
diff --git a/src/lib/prov/tpm2/tpm2_pkops.cpp b/src/lib/prov/tpm2/tpm2_pkops.cpp
index bf1b9c48f5c..fb29381916b 100644
--- a/src/lib/prov/tpm2/tpm2_pkops.cpp
+++ b/src/lib/prov/tpm2/tpm2_pkops.cpp
@@ -70,7 +70,7 @@ std::vector<uint8_t> Signature_Operation::sign(Botan::RandomNumberGenerator& rng
    };
 
    auto signature = [&] {
-      if(auto h = dynamic_cast<HashFunction*>(hash())) {
+      if(auto* h = dynamic_cast<HashFunction*>(hash())) {
          // This is a TPM2-based hash object that calculated the digest on
          // the TPM. We can use the validation ticket to create the signature.
          auto [digest, validation] = h->final_with_ticket();
diff --git a/src/lib/pubkey/classic_mceliece/cmce_poly.cpp b/src/lib/pubkey/classic_mceliece/cmce_poly.cpp
index 0890609aab3..9066492452a 100644
--- a/src/lib/pubkey/classic_mceliece/cmce_poly.cpp
+++ b/src/lib/pubkey/classic_mceliece/cmce_poly.cpp
@@ -126,12 +126,12 @@ std::optional<Classic_McEliece_Minimal_Polynomial> Classic_McEliece_Polynomial_R
 
 secure_vector<uint8_t> Classic_McEliece_Minimal_Polynomial::serialize() const {
    BOTAN_ASSERT_NOMSG(!coef().empty());
-   auto& all_coeffs = coef();
+   const auto& all_coeffs = coef();
    // Store all except coef for monomial x^t since polynomial is monic (ISO Spec Section 9.2.9)
    auto coeffs_to_store = std::span(all_coeffs).first(all_coeffs.size() - 1);
    secure_vector<uint8_t> bytes(sizeof(uint16_t) * coeffs_to_store.size());
    BufferStuffer bytes_stuf(bytes);
-   for(auto& coef : coeffs_to_store) {
+   for(const auto& coef : coeffs_to_store) {
       store_le(bytes_stuf.next<sizeof(CmceGfElem)>(), coef.elem().get());
    }
    BOTAN_ASSERT_NOMSG(bytes_stuf.full());
diff --git a/src/lib/pubkey/hss_lms/hss.cpp b/src/lib/pubkey/hss_lms/hss.cpp
index cee9b204004..ae14316ee52 100644
--- a/src/lib/pubkey/hss_lms/hss.cpp
+++ b/src/lib/pubkey/hss_lms/hss.cpp
@@ -273,7 +273,7 @@ std::vector<uint8_t> HSS_LMS_PrivateKeyInternal::sign(std::span<const uint8_t> m
 }
 
 LMS_PrivateKey HSS_LMS_PrivateKeyInternal::hss_derive_root_lms_private_key() const {
-   auto& top_params = hss_params().params_at_level(HSS_Level(0));
+   const auto& top_params = hss_params().params_at_level(HSS_Level(0));
    return LMS_PrivateKey(top_params.lms_params(), top_params.lmots_params(), m_identifier, m_hss_seed);
 }
 
@@ -303,7 +303,7 @@ LMS_PrivateKey HSS_LMS_PrivateKeyInternal::hss_derive_child_lms_private_key(
 }
 
 HSS_LMS_PublicKeyInternal HSS_LMS_PublicKeyInternal::create(const HSS_LMS_PrivateKeyInternal& hss_sk) {
-   auto& hss_params = hss_sk.hss_params();
+   const auto& hss_params = hss_sk.hss_params();
 
    const auto root_sk = hss_sk.hss_derive_root_lms_private_key();
    LMS_PublicKey top_pub_key = LMS_PublicKey(root_sk);
diff --git a/src/lib/pubkey/kex_to_kem_adapter/kex_to_kem_adapter.cpp b/src/lib/pubkey/kex_to_kem_adapter/kex_to_kem_adapter.cpp
index c25de0ea9f4..b58b25fac36 100644
--- a/src/lib/pubkey/kex_to_kem_adapter/kex_to_kem_adapter.cpp
+++ b/src/lib/pubkey/kex_to_kem_adapter/kex_to_kem_adapter.cpp
@@ -89,7 +89,7 @@ std::unique_ptr<PK_Key_Agreement_Key> generate_key_agreement_private_key(const P
 
    auto new_kex_key = [&] {
       auto new_private_key = kex_public_key.generate_another(rng);
-      const auto kex_key = dynamic_cast<PK_Key_Agreement_Key*>(new_private_key.get());
+      auto* const kex_key = dynamic_cast<PK_Key_Agreement_Key*>(new_private_key.get());
       if(kex_key) [[likely]] {
          // Intentionally leak new_private_key since we hold an alias of it in kex_key,
          // which is captured in a unique_ptr below
@@ -224,8 +224,8 @@ bool KEX_to_KEM_Adapter_PublicKey::supports_operation(PublicKeyOperation op) con
 namespace {
 
 std::unique_ptr<PK_Key_Agreement_Key> capture_as_ka_key(std::unique_ptr<Private_Key> private_key) {
-   auto raw_ptr = private_key.release();
-   if(auto sk = dynamic_cast<PK_Key_Agreement_Key*>(raw_ptr)) {
+   auto* raw_ptr = private_key.release();
+   if(auto* sk = dynamic_cast<PK_Key_Agreement_Key*>(raw_ptr)) {
       return std::unique_ptr<PK_Key_Agreement_Key>(sk);
    } else {
       delete raw_ptr;
diff --git a/src/lib/pubkey/kyber/kyber_common/kyber_algos.cpp b/src/lib/pubkey/kyber/kyber_common/kyber_algos.cpp
index 4621d5788ec..5dd47fb3134 100644
--- a/src/lib/pubkey/kyber/kyber_common/kyber_algos.cpp
+++ b/src/lib/pubkey/kyber/kyber_common/kyber_algos.cpp
@@ -183,7 +183,7 @@ void sample_poly_cbd<KyberConstants::KyberEta::_3>(KyberPoly& poly,
 
 void encode_polynomial_vector(std::span<uint8_t> out, const KyberPolyVecNTT& vec) {
    BufferStuffer bs(out);
-   for(auto& v : vec) {
+   for(const auto& v : vec) {
       byte_encode(bs, v);
    }
    BOTAN_ASSERT_NOMSG(bs.full());
diff --git a/src/lib/tls/msg_cert_verify.cpp b/src/lib/tls/msg_cert_verify.cpp
index c0a8312f75d..f86f7610501 100644
--- a/src/lib/tls/msg_cert_verify.cpp
+++ b/src/lib/tls/msg_cert_verify.cpp
@@ -149,7 +149,7 @@ Certificate_Verify_13::Certificate_Verify_13(const Certificate_13& certificate_m
       m_side(whoami) {
    BOTAN_ASSERT_NOMSG(!certificate_msg.empty());
 
-   const auto op_type = (m_side == Connection_Side::Client) ? "tls-client" : "tls-server";
+   const std::string op_type((m_side == Connection_Side::Client) ? "tls-client" : "tls-server");
    const auto context = std::string(hostname);
 
    const auto private_key = (certificate_msg.has_certificate_chain())
diff --git a/src/lib/tls/msg_client_hello.cpp b/src/lib/tls/msg_client_hello.cpp
index 7c3237fbc36..6492ec9152f 100644
--- a/src/lib/tls/msg_client_hello.cpp
+++ b/src/lib/tls/msg_client_hello.cpp
@@ -371,7 +371,7 @@ bool Client_Hello::sent_signature_algorithms() const {
 }
 
 std::vector<std::string> Client_Hello::next_protocols() const {
-   if(auto alpn = m_data->extensions().get<Application_Layer_Protocol_Notification>()) {
+   if(auto* alpn = m_data->extensions().get<Application_Layer_Protocol_Notification>()) {
       return alpn->protocols();
    }
    return {};
@@ -700,7 +700,7 @@ Client_Hello_13::Client_Hello_13(std::unique_ptr<Client_Hello_Internal> data) :
    }
 
    if(exts.has<Key_Share>()) {
-      const auto supported_ext = exts.get<Supported_Groups>();
+      auto* const supported_ext = exts.get<Supported_Groups>();
       BOTAN_ASSERT_NONNULL(supported_ext);
       const auto supports = supported_ext->groups();
       const auto offers = exts.get<Key_Share>()->offered_groups();
@@ -881,7 +881,7 @@ void Client_Hello_13::retry(const Hello_Retry_Request& hrr,
    BOTAN_STATE_CHECK(m_data->extensions().has<Supported_Groups>());
    BOTAN_STATE_CHECK(m_data->extensions().has<Key_Share>());
 
-   auto hrr_ks = hrr.extensions().get<Key_Share>();
+   auto* hrr_ks = hrr.extensions().get<Key_Share>();
    const auto& supported_groups = m_data->extensions().get<Supported_Groups>()->groups();
 
    if(hrr.extensions().has<Key_Share>()) {
@@ -907,7 +907,7 @@ void Client_Hello_13::retry(const Hello_Retry_Request& hrr,
    //       that the user keeps and detects this state themselves.
    cb.tls_modify_extensions(m_data->extensions(), Connection_Side::Client, type());
 
-   auto psk = m_data->extensions().get<PSK>();
+   auto* psk = m_data->extensions().get<PSK>();
    if(psk) {
       // Cipher suite should always be a known suite as this is checked upstream
       const auto cipher = Ciphersuite::by_id(hrr.ciphersuite());
@@ -944,7 +944,7 @@ void Client_Hello_13::validate_updates(const Client_Hello_13& new_ch) {
    // Check that extension omissions are justified
    for(const auto oldext : oldexts) {
       if(!newexts.contains(oldext)) {
-         const auto ext = extensions().get(oldext);
+         auto* const ext = extensions().get(oldext);
 
          // We don't make any assumptions about unimplemented extensions.
          if(!ext->is_implemented()) {
@@ -973,7 +973,7 @@ void Client_Hello_13::validate_updates(const Client_Hello_13& new_ch) {
    // Check that extension additions are justified
    for(const auto newext : newexts) {
       if(!oldexts.contains(newext)) {
-         const auto ext = new_ch.extensions().get(newext);
+         auto* const ext = new_ch.extensions().get(newext);
 
          // We don't make any assumptions about unimplemented extensions.
          if(!ext->is_implemented()) {
@@ -1023,7 +1023,7 @@ void Client_Hello_13::validate_updates(const Client_Hello_13& new_ch) {
 }
 
 void Client_Hello_13::calculate_psk_binders(Transcript_Hash_State ths) {
-   auto psk = m_data->extensions().get<PSK>();
+   auto* psk = m_data->extensions().get<PSK>();
    if(!psk || psk->empty()) {
       return;
    }
@@ -1047,7 +1047,7 @@ std::optional<Protocol_Version> Client_Hello_13::highest_supported_version(const
    //    which versions of TLS it supports and by the server to indicate which
    //    version it is using. The extension contains a list of supported
    //    versions in preference order, with the most preferred version first.
-   const auto supvers = m_data->extensions().get<Supported_Versions>();
+   auto* const supvers = m_data->extensions().get<Supported_Versions>();
    BOTAN_ASSERT_NONNULL(supvers);
 
    std::optional<Protocol_Version> result;
diff --git a/src/lib/tls/msg_server_hello.cpp b/src/lib/tls/msg_server_hello.cpp
index 2adb988311c..c659d70bd3f 100644
--- a/src/lib/tls/msg_server_hello.cpp
+++ b/src/lib/tls/msg_server_hello.cpp
@@ -57,7 +57,7 @@ std::vector<uint8_t> make_server_hello_random(RandomNumberGenerator& rng,
    if(offered_version.is_pre_tls_13() && policy.allow_tls13()) {
       constexpr size_t downgrade_signal_length = sizeof(DOWNGRADE_TLS12);
       BOTAN_ASSERT_NOMSG(random.size() >= downgrade_signal_length);
-      auto lastbytes = random.data() + random.size() - downgrade_signal_length;
+      auto* lastbytes = random.data() + random.size() - downgrade_signal_length;
       store_be(DOWNGRADE_TLS12, lastbytes);
    }
 
@@ -388,7 +388,7 @@ bool Server_Hello_12::supports_session_ticket() const {
 }
 
 uint16_t Server_Hello_12::srtp_profile() const {
-   if(auto srtp = m_data->extensions().get<SRTP_Protection_Profiles>()) {
+   if(auto* srtp = m_data->extensions().get<SRTP_Protection_Profiles>()) {
       auto prof = srtp->profiles();
       if(prof.size() != 1 || prof[0] == 0) {
          throw Decoding_Error("Server sent malformed DTLS-SRTP extension");
@@ -400,14 +400,14 @@ uint16_t Server_Hello_12::srtp_profile() const {
 }
 
 std::string Server_Hello_12::next_protocol() const {
-   if(auto alpn = m_data->extensions().get<Application_Layer_Protocol_Notification>()) {
+   if(auto* alpn = m_data->extensions().get<Application_Layer_Protocol_Notification>()) {
       return alpn->single_protocol();
    }
    return "";
 }
 
 bool Server_Hello_12::prefers_compressed_ec_points() const {
-   if(auto ecc_formats = m_data->extensions().get<Supported_Point_Formats>()) {
+   if(auto* ecc_formats = m_data->extensions().get<Supported_Point_Formats>()) {
       return ecc_formats->prefers_compressed();
    }
    return false;
@@ -730,7 +730,7 @@ Server_Hello_13::Server_Hello_13(const Client_Hello_13& ch,
          key_exchange_group.value(), *ch.extensions().get<Key_Share>(), policy, cb, rng));
    }
 
-   auto& ch_exts = ch.extensions();
+   const auto& ch_exts = ch.extensions();
 
    if(ch_exts.has<PSK>()) {
       const auto cs = Ciphersuite::by_id(m_data->ciphersuite());
@@ -741,7 +741,7 @@ Server_Hello_13::Server_Hello_13(const Client_Hello_13& ch,
       //    offers a "pre_shared_key" extension.
       //
       // Note: Client_Hello_13 constructor already performed a graceful check.
-      const auto psk_modes = ch_exts.get<PSK_Key_Exchange_Modes>();
+      auto* const psk_modes = ch_exts.get<PSK_Key_Exchange_Modes>();
       BOTAN_ASSERT_NONNULL(psk_modes);
 
       // TODO: also support PSK_Key_Exchange_Mode::PSK_KE
@@ -773,7 +773,7 @@ std::optional<Protocol_Version> Server_Hello_13::random_signals_downgrade() cons
 }
 
 Protocol_Version Server_Hello_13::selected_version() const {
-   const auto versions_ext = m_data->extensions().get<Supported_Versions>();
+   auto* const versions_ext = m_data->extensions().get<Supported_Versions>();
    BOTAN_ASSERT_NOMSG(versions_ext);
    const auto& versions = versions_ext->versions();
    BOTAN_ASSERT_NOMSG(versions.size() == 1);
diff --git a/src/lib/tls/sessions_sql/tls_session_manager_sql.cpp b/src/lib/tls/sessions_sql/tls_session_manager_sql.cpp
index f7e0e777bda..c35f0ed3f1c 100644
--- a/src/lib/tls/sessions_sql/tls_session_manager_sql.cpp
+++ b/src/lib/tls/sessions_sql/tls_session_manager_sql.cpp
@@ -93,7 +93,7 @@ void Session_Manager_SQL::create_with_latest_schema(std::string_view passphrase,
 
    secure_vector<uint8_t> derived_key(32 + 2);
 
-   const auto pbkdf_name = "PBKDF2(SHA-512)";
+   const std::string pbkdf_name = "PBKDF2(SHA-512)";
    auto pbkdf_fam = PasswordHashFamily::create_or_throw(pbkdf_name);
 
    auto desired_runtime = std::chrono::milliseconds(100);
diff --git a/src/lib/tls/tls12/msg_client_kex.cpp b/src/lib/tls/tls12/msg_client_kex.cpp
index c9621131189..6d8838fb59d 100644
--- a/src/lib/tls/tls12/msg_client_kex.cpp
+++ b/src/lib/tls/tls12/msg_client_kex.cpp
@@ -118,7 +118,7 @@ Client_Key_Exchange::Client_Key_Exchange(Handshake_IO& io,
          }
 
          if(curve_id.is_ecdh_named_curve()) {
-            auto ecdh_key = dynamic_cast<ECDH_PublicKey*>(private_key.get());
+            auto* ecdh_key = dynamic_cast<ECDH_PublicKey*>(private_key.get());
             if(!ecdh_key) {
                throw TLS_Exception(Alert::InternalError, "Application did not provide a ECDH_PublicKey");
             }
@@ -146,7 +146,7 @@ Client_Key_Exchange::Client_Key_Exchange(Handshake_IO& io,
          throw Internal_Error("No server public key for RSA exchange");
       }
 
-      if(auto rsa_pub = dynamic_cast<const RSA_PublicKey*>(server_public_key)) {
+      if(const auto* rsa_pub = dynamic_cast<const RSA_PublicKey*>(server_public_key)) {
          const Protocol_Version offered_version = state.client_hello()->legacy_version();
 
          rng.random_vec(m_pre_master, 48);
diff --git a/src/lib/tls/tls12/msg_server_kex.cpp b/src/lib/tls/tls12/msg_server_kex.cpp
index 8d946d21c39..e40e07f696b 100644
--- a/src/lib/tls/tls12/msg_server_kex.cpp
+++ b/src/lib/tls/tls12/msg_server_kex.cpp
@@ -84,7 +84,7 @@ Server_Key_Exchange::Server_Key_Exchange(Handshake_IO& io,
       // `Policy::default_dh_group()` could return a `std::variant<Group_Params,
       // DL_Group>`, allowing it to define arbitrary groups.
       m_kex_key = state.callbacks().tls_generate_ephemeral_key(m_shared_group.value(), rng);
-      auto dh = dynamic_cast<DH_PrivateKey*>(m_kex_key.get());
+      auto* dh = dynamic_cast<DH_PrivateKey*>(m_kex_key.get());
       if(!dh) {
          throw TLS_Exception(Alert::InternalError, "Application did not provide a Diffie-Hellman key");
       }
@@ -115,7 +115,7 @@ Server_Key_Exchange::Server_Key_Exchange(Handshake_IO& io,
          ecdh_public_val = m_kex_key->public_value();
       } else {
          m_kex_key = state.callbacks().tls_generate_ephemeral_key(m_shared_group.value(), rng);
-         auto ecdh = dynamic_cast<ECDH_PrivateKey*>(m_kex_key.get());
+         auto* ecdh = dynamic_cast<ECDH_PrivateKey*>(m_kex_key.get());
          if(!ecdh) {
             throw TLS_Exception(Alert::InternalError, "Application did not provide a EC-Diffie-Hellman key");
          }
diff --git a/src/lib/tls/tls12/tls_channel_impl_12.cpp b/src/lib/tls/tls12/tls_channel_impl_12.cpp
index f107b30b009..a387728cb6b 100644
--- a/src/lib/tls/tls12/tls_channel_impl_12.cpp
+++ b/src/lib/tls/tls12/tls_channel_impl_12.cpp
@@ -94,7 +94,7 @@ std::shared_ptr<Connection_Cipher_State> Channel_Impl_12::write_cipher_state_epo
 }
 
 std::vector<X509_Certificate> Channel_Impl_12::peer_cert_chain() const {
-   if(auto active = active_state()) {
+   if(const auto* active = active_state()) {
       return get_peer_cert_chain(*active);
    }
    return std::vector<X509_Certificate>();
@@ -114,7 +114,7 @@ Handshake_State& Channel_Impl_12::create_handshake_state(Protocol_Version versio
       throw Internal_Error("create_handshake_state called during handshake");
    }
 
-   if(auto active = active_state()) {
+   if(const auto* active = active_state()) {
       Protocol_Version active_version = active->version();
 
       if(active_version.is_datagram_protocol() != version.is_datagram_protocol()) {
@@ -154,7 +154,7 @@ Handshake_State& Channel_Impl_12::create_handshake_state(Protocol_Version versio
 
    m_pending_state = new_handshake_state(std::move(io));
 
-   if(auto active = active_state()) {
+   if(const auto* active = active_state()) {
       m_pending_state->set_version(active->version());
    }
 
@@ -175,7 +175,7 @@ void Channel_Impl_12::renegotiate(bool force_full_renegotiation) {
       return;
    }
 
-   if(auto active = active_state()) {
+   if(const auto* active = active_state()) {
       if(force_full_renegotiation == false) {
          force_full_renegotiation = !policy().allow_resumption_for_renegotiation();
       }
@@ -191,7 +191,7 @@ void Channel_Impl_12::update_traffic_keys(bool) {
 }
 
 void Channel_Impl_12::change_cipher_spec_reader(Connection_Side side) {
-   auto pending = pending_state();
+   const auto* pending = pending_state();
 
    BOTAN_ASSERT(pending && pending->server_hello(), "Have received server hello");
 
@@ -218,7 +218,7 @@ void Channel_Impl_12::change_cipher_spec_reader(Connection_Side side) {
 }
 
 void Channel_Impl_12::change_cipher_spec_writer(Connection_Side side) {
-   auto pending = pending_state();
+   const auto* pending = pending_state();
 
    BOTAN_ASSERT(pending && pending->server_hello(), "Have received server hello");
 
@@ -275,7 +275,7 @@ void Channel_Impl_12::activate_session() {
 size_t Channel_Impl_12::from_peer(std::span<const uint8_t> data) {
    const bool allow_epoch0_restart = m_is_datagram && m_is_server && policy().allow_dtls_epoch0_restart();
 
-   auto input = data.data();
+   const auto* input = data.data();
    auto input_size = data.size();
 
    try {
@@ -334,12 +334,12 @@ size_t Channel_Impl_12::from_peer(std::span<const uint8_t> data) {
                if(record.version().major_version() != 3 && record.version().major_version() != 0xFE) {
                   throw TLS_Exception(Alert::ProtocolVersion, "Received unexpected record version in initial record");
                }
-            } else if(auto pending = pending_state()) {
+            } else if(const auto* pending = pending_state()) {
                if(pending->server_hello() != nullptr && !initial_handshake_message &&
                   record.version() != pending->version()) {
                   throw TLS_Exception(Alert::ProtocolVersion, "Received unexpected record version");
                }
-            } else if(auto active = active_state()) {
+            } else if(const auto* active = active_state()) {
                if(record.version() != active->version() && !initial_handshake_message) {
                   throw TLS_Exception(Alert::ProtocolVersion, "Received unexpected record version");
                }
@@ -418,7 +418,7 @@ void Channel_Impl_12::process_handshake_ccs(const secure_vector<uint8_t>& record
    if(m_pending_state) {
       m_pending_state->handshake_io().add_record(record.data(), record.size(), record_type, record_sequence);
 
-      while(auto pending = m_pending_state.get()) {
+      while(auto* pending = m_pending_state.get()) {
          auto msg = pending->get_next_handshake_msg();
 
          if(msg.first == Handshake_Type::None) {  // no full handshake yet
@@ -452,7 +452,7 @@ void Channel_Impl_12::process_alert(const secure_vector<uint8_t>& record) {
    callbacks().tls_alert(alert_msg);
 
    if(alert_msg.is_fatal()) {
-      if(auto active = active_state()) {
+      if(const auto* active = active_state()) {
          const auto& session_id = active->server_hello()->session_id();
          if(!session_id.empty()) {
             session_manager().remove(Session_Handle(session_id));
@@ -541,7 +541,7 @@ void Channel_Impl_12::send_alert(const Alert& alert) {
    }
 
    if(alert.is_fatal()) {
-      if(auto active = active_state()) {
+      if(const auto* active = active_state()) {
          const auto& session_id = active->server_hello()->session_id();
          if(!session_id.empty()) {
             session_manager().remove(Session_Handle(Session_ID(session_id)));
@@ -558,7 +558,7 @@ void Channel_Impl_12::send_alert(const Alert& alert) {
 void Channel_Impl_12::secure_renegotiation_check(const Client_Hello_12* client_hello) {
    const bool secure_renegotiation = client_hello->secure_renegotiation();
 
-   if(auto active = active_state()) {
+   if(const auto* active = active_state()) {
       const bool active_sr = active->client_hello()->secure_renegotiation();
 
       if(active_sr != secure_renegotiation) {
@@ -578,7 +578,7 @@ void Channel_Impl_12::secure_renegotiation_check(const Client_Hello_12* client_h
 void Channel_Impl_12::secure_renegotiation_check(const Server_Hello_12* server_hello) {
    const bool secure_renegotiation = server_hello->secure_renegotiation();
 
-   if(auto active = active_state()) {
+   if(const auto* active = active_state()) {
       const bool active_sr = active->server_hello()->secure_renegotiation();
 
       if(active_sr != secure_renegotiation) {
@@ -596,14 +596,14 @@ void Channel_Impl_12::secure_renegotiation_check(const Server_Hello_12* server_h
 }
 
 std::vector<uint8_t> Channel_Impl_12::secure_renegotiation_data_for_client_hello() const {
-   if(auto active = active_state()) {
+   if(const auto* active = active_state()) {
       return active->client_finished()->verify_data();
    }
    return std::vector<uint8_t>();
 }
 
 std::vector<uint8_t> Channel_Impl_12::secure_renegotiation_data_for_server_hello() const {
-   if(auto active = active_state()) {
+   if(const auto* active = active_state()) {
       std::vector<uint8_t> buf = active->client_finished()->verify_data();
       buf += active->server_finished()->verify_data();
       return buf;
@@ -613,12 +613,12 @@ std::vector<uint8_t> Channel_Impl_12::secure_renegotiation_data_for_server_hello
 }
 
 bool Channel_Impl_12::secure_renegotiation_supported() const {
-   if(auto active = active_state()) {
+   if(const auto* active = active_state()) {
       return active->server_hello()->secure_renegotiation();
    }
 
-   if(auto pending = pending_state()) {
-      if(auto hello = pending->server_hello()) {
+   if(const auto* pending = pending_state()) {
+      if(const auto* hello = pending->server_hello()) {
          return hello->secure_renegotiation();
       }
    }
@@ -629,7 +629,7 @@ bool Channel_Impl_12::secure_renegotiation_supported() const {
 SymmetricKey Channel_Impl_12::key_material_export(std::string_view label,
                                                   std::string_view context,
                                                   size_t length) const {
-   if(auto active = active_state()) {
+   if(const auto* active = active_state()) {
       if(pending_state() != nullptr) {
          throw Invalid_State("Channel_Impl_12::key_material_export cannot export during renegotiation");
       }
diff --git a/src/lib/tls/tls12/tls_client_impl_12.cpp b/src/lib/tls/tls12/tls_client_impl_12.cpp
index 05fde40a775..febca60476d 100644
--- a/src/lib/tls/tls12/tls_client_impl_12.cpp
+++ b/src/lib/tls/tls12/tls_client_impl_12.cpp
@@ -700,7 +700,7 @@ void Client_Impl_12::process_handshake_msg(const Handshake_State* active_state,
       callbacks().tls_session_established([&, this] {
          Session_Summary summary(session_info, state.is_a_resumption(), external_psk_identity());
          summary.set_session_id(state.server_hello()->session_id());
-         if(auto nst = state.new_session_ticket()) {
+         if(const auto* nst = state.new_session_ticket()) {
             summary.set_session_ticket(nst->ticket());
          }
          return summary;
diff --git a/src/lib/tls/tls13/msg_certificate_13.cpp b/src/lib/tls/tls13/msg_certificate_13.cpp
index 0aba0c0317e..2add4c28cd9 100644
--- a/src/lib/tls/tls13/msg_certificate_13.cpp
+++ b/src/lib/tls/tls13/msg_certificate_13.cpp
@@ -192,7 +192,7 @@ Certificate_13::Certificate_13(const Certificate_Request_13& cert_request,
                                Certificate_Type cert_type) :
       m_request_context(cert_request.context()), m_side(Connection_Side::Client) {
    const auto key_types = filter_signature_schemes(cert_request.signature_schemes());
-   const auto op_type = "tls-client";
+   const std::string op_type = "tls-client";
 
    if(cert_type == Certificate_Type::X509) {
       setup_entries(
@@ -233,8 +233,8 @@ Certificate_13::Certificate_13(const Client_Hello_13& client_hello,
    BOTAN_ASSERT_NOMSG(client_hello.extensions().has<Signature_Algorithms>());
 
    const auto key_types = filter_signature_schemes(client_hello.signature_schemes());
-   const auto op_type = "tls-server";
-   const auto context = client_hello.sni_hostname();
+   const std::string op_type = "tls-server";
+   const std::string context = client_hello.sni_hostname();
 
    if(cert_type == Certificate_Type::X509) {
       auto cert_chain = credentials_manager.find_cert_chain(
diff --git a/src/lib/tls/tls13/msg_certificate_req_13.cpp b/src/lib/tls/tls13/msg_certificate_req_13.cpp
index d26063e74e1..963db3c9236 100644
--- a/src/lib/tls/tls13/msg_certificate_req_13.cpp
+++ b/src/lib/tls/tls13/msg_certificate_req_13.cpp
@@ -108,7 +108,7 @@ std::optional<Certificate_Request_13> Certificate_Request_13::maybe_create(const
    const auto trusted_CAs = cred_mgr.trusted_certificate_authorities("tls-server", client_hello.sni_hostname());
 
    std::vector<X509_DN> client_auth_CAs;
-   for(const auto store : trusted_CAs) {
+   for(auto* const store : trusted_CAs) {
       const auto subjects = store->all_subjects();
       client_auth_CAs.insert(client_auth_CAs.end(), subjects.begin(), subjects.end());
    }
@@ -140,7 +140,7 @@ const std::vector<Signature_Scheme>& Certificate_Request_13::certificate_signatu
    //   If no "signature_algorithms_cert" extension is present, then the
    //   "signature_algorithms" extension also applies to signatures appearing
    //   in certificates.
-   if(auto sig_schemes_cert = m_extensions.get<Signature_Algorithms_Cert>()) {
+   if(auto* sig_schemes_cert = m_extensions.get<Signature_Algorithms_Cert>()) {
       return sig_schemes_cert->supported_schemes();
    } else {
       return signature_schemes();
diff --git a/src/lib/tls/tls13/msg_encrypted_extensions.cpp b/src/lib/tls/tls13/msg_encrypted_extensions.cpp
index 266d8f16153..fd49e3ed74c 100644
--- a/src/lib/tls/tls13/msg_encrypted_extensions.cpp
+++ b/src/lib/tls/tls13/msg_encrypted_extensions.cpp
@@ -52,7 +52,7 @@ Encrypted_Extensions::Encrypted_Extensions(const Client_Hello_13& client_hello,
    //    If the server does not send a certificate_request payload [...],
    //    then the client_certificate_type payload in the server hello MUST be
    //    omitted.
-   if(auto ch_client_cert_types = exts.get<Client_Certificate_Type>();
+   if(auto* ch_client_cert_types = exts.get<Client_Certificate_Type>();
       ch_client_cert_types && policy.request_client_certificate_authentication()) {
       m_extensions.add(new Client_Certificate_Type(*ch_client_cert_types, policy));
    }
@@ -63,7 +63,7 @@ Encrypted_Extensions::Encrypted_Extensions(const Client_Hello_13& client_hello,
    //    the server in a subsequent certificate payload. [...] With the
    //    server_certificate_type extension in the server hello, the TLS server
    //    indicates the certificate type carried in the Certificate payload.
-   if(auto ch_server_cert_types = exts.get<Server_Certificate_Type>()) {
+   if(auto* ch_server_cert_types = exts.get<Server_Certificate_Type>()) {
       m_extensions.add(new Server_Certificate_Type(*ch_server_cert_types, policy));
    }
 
@@ -76,7 +76,7 @@ Encrypted_Extensions::Encrypted_Extensions(const Client_Hello_13& client_hello,
       m_extensions.add(new Server_Name_Indicator(""));
    }
 
-   if(auto alpn_ext = exts.get<Application_Layer_Protocol_Notification>()) {
+   if(auto* alpn_ext = exts.get<Application_Layer_Protocol_Notification>()) {
       const auto next_protocol = cb.tls_server_choose_app_protocol(alpn_ext->protocols());
       if(!next_protocol.empty()) {
          m_extensions.add(new Application_Layer_Protocol_Notification(next_protocol));
diff --git a/src/lib/tls/tls13/tls_client_impl_13.cpp b/src/lib/tls/tls13/tls_client_impl_13.cpp
index abde93088bd..42a94868381 100644
--- a/src/lib/tls/tls13/tls_client_impl_13.cpp
+++ b/src/lib/tls/tls13/tls_client_impl_13.cpp
@@ -303,7 +303,7 @@ void Client_Impl_13::handle(const Server_Hello_13& sh) {
       throw TLS_Exception(Alert::IllegalParameter, "Server Hello did not contain a key share extension");
    }
 
-   auto my_keyshare = ch.extensions().get<Key_Share>();
+   auto* my_keyshare = ch.extensions().get<Key_Share>();
    auto shared_secret = my_keyshare->decapsulate(*sh.extensions().get<Key_Share>(), policy(), callbacks(), rng());
 
    m_transcript_hash.set_algorithm(cipher.value().prf_algo());
@@ -398,8 +398,8 @@ void Client_Impl_13::handle(const Encrypted_Extensions& encrypted_extensions_msg
       //
       // Hence, the "outgoing" limit is what the server requested and the
       // "incoming" limit is what we requested in the Client Hello.
-      const auto outgoing_limit = exts.get<Record_Size_Limit>();
-      const auto incoming_limit = m_handshake_state.client_hello().extensions().get<Record_Size_Limit>();
+      auto* const outgoing_limit = exts.get<Record_Size_Limit>();
+      auto* const incoming_limit = m_handshake_state.client_hello().extensions().get<Record_Size_Limit>();
       set_record_size_limits(outgoing_limit->limit(), incoming_limit->limit());
    }
 
diff --git a/src/lib/tls/tls13/tls_extensions_key_share.cpp b/src/lib/tls/tls13/tls_extensions_key_share.cpp
index b128aa1a727..cc5102c9374 100644
--- a/src/lib/tls/tls13/tls_extensions_key_share.cpp
+++ b/src/lib/tls/tls13/tls_extensions_key_share.cpp
@@ -58,7 +58,7 @@ class Key_Share_Entry {
          if(group.is_kem()) {
             m_key_exchange = m_private_key->public_key_bits();
          } else if(group.is_ecdh_named_curve()) {
-            auto pkey = dynamic_cast<ECDH_PublicKey*>(m_private_key.get());
+            auto* pkey = dynamic_cast<ECDH_PublicKey*>(m_private_key.get());
             if(!pkey) {
                throw TLS_Exception(Alert::InternalError, "Application did not provide a ECDH_PublicKey");
             }
@@ -73,7 +73,7 @@ class Key_Share_Entry {
             // ClientHello::prefers_compressed_ec_points() into account here.
             m_key_exchange = pkey->public_value(EC_Point_Format::Uncompressed);
          } else {
-            auto pkey = dynamic_cast<PK_Key_Agreement_Key*>(m_private_key.get());
+            auto* pkey = dynamic_cast<PK_Key_Agreement_Key*>(m_private_key.get());
             if(!pkey) {
                throw TLS_Exception(Alert::InternalError, "Application did not provide a key-agreement key");
             }
diff --git a/src/lib/tls/tls13/tls_server_impl_13.cpp b/src/lib/tls/tls13/tls_server_impl_13.cpp
index 50f2719c073..64fbbc39a27 100644
--- a/src/lib/tls/tls13/tls_server_impl_13.cpp
+++ b/src/lib/tls/tls13/tls_server_impl_13.cpp
@@ -34,7 +34,7 @@ Server_Impl_13::Server_Impl_13(const std::shared_ptr<Callbacks>& callbacks,
 std::string Server_Impl_13::application_protocol() const {
    if(is_handshake_complete()) {
       const auto& eee = m_handshake_state.encrypted_extensions().extensions();
-      if(const auto alpn = eee.get<Application_Layer_Protocol_Notification>()) {
+      if(auto* const alpn = eee.get<Application_Layer_Protocol_Notification>()) {
          return alpn->single_protocol();
       }
    }
@@ -230,7 +230,7 @@ void Server_Impl_13::handle_reply_to_client_hello(Server_Hello_13 server_hello)
 
    std::unique_ptr<Cipher_State> psk_cipher_state;
    if(uses_psk) {
-      auto psk_extension = server_hello.extensions().get<PSK>();
+      auto* psk_extension = server_hello.extensions().get<PSK>();
 
       psk_cipher_state =
          std::visit(overloaded{[&, this](Session session) {
@@ -288,7 +288,7 @@ void Server_Impl_13::handle_reply_to_client_hello(Server_Hello_13 server_hello)
    // Setup encryption for all the remaining handshake messages
    m_cipher_state = [&] {
       // Currently, PSK without DHE is not implemented...
-      const auto my_keyshare = m_handshake_state.server_hello().extensions().get<Key_Share>();
+      auto* const my_keyshare = m_handshake_state.server_hello().extensions().get<Key_Share>();
       BOTAN_ASSERT_NONNULL(my_keyshare);
 
       if(uses_psk) {
@@ -326,7 +326,7 @@ void Server_Impl_13::handle_reply_to_client_hello(Server_Hello_13 server_hello)
       //
       // Note: TLS 1.3 carries this extension in the Encrypted Extensions
       //       message instead of the Server Hello.
-      if(auto client_cert_type = enc_exts.get<Client_Certificate_Type>()) {
+      if(auto* client_cert_type = enc_exts.get<Client_Certificate_Type>()) {
          set_selected_certificate_type(client_cert_type->selected_certificate_type());
       }
 
@@ -336,7 +336,7 @@ void Server_Impl_13::handle_reply_to_client_hello(Server_Hello_13 server_hello)
       //    was negotiated, then each CertificateEntry contains a DER-encoded
       //    X.509 certificate.
       const auto cert_type = [&] {
-         if(auto server_cert_type = enc_exts.get<Server_Certificate_Type>()) {
+         if(auto* server_cert_type = enc_exts.get<Server_Certificate_Type>()) {
             return server_cert_type->selected_certificate_type();
          } else {
             return Certificate_Type::X509;
@@ -374,8 +374,8 @@ void Server_Impl_13::handle_reply_to_client_hello(Server_Hello_13 server_hello)
       //
       // Hence, the "outgoing" limit is what the client requested and the
       // "incoming" limit is what we will request in the Encrypted Extensions.
-      const auto outgoing_limit = client_hello.extensions().get<Record_Size_Limit>();
-      const auto incoming_limit = m_handshake_state.encrypted_extensions().extensions().get<Record_Size_Limit>();
+      auto* const outgoing_limit = client_hello.extensions().get<Record_Size_Limit>();
+      auto* const incoming_limit = m_handshake_state.encrypted_extensions().extensions().get<Record_Size_Limit>();
       set_record_size_limits(outgoing_limit->limit(), incoming_limit->limit());
    }
 
diff --git a/src/lib/tls/tls13/tls_transcript_hash_13.cpp b/src/lib/tls/tls13/tls_transcript_hash_13.cpp
index b2ab1d0975c..8eb5ee03ca4 100644
--- a/src/lib/tls/tls13/tls_transcript_hash_13.cpp
+++ b/src/lib/tls/tls13/tls_transcript_hash_13.cpp
@@ -145,7 +145,7 @@ std::vector<uint8_t> read_hash_state(std::unique_ptr<HashFunction>& hash) {
 }  // namespace
 
 void Transcript_Hash_State::update(std::span<const uint8_t> serialized_message_s) {
-   auto serialized_message = serialized_message_s.data();
+   const auto* serialized_message = serialized_message_s.data();
    auto serialized_message_length = serialized_message_s.size();
    if(m_hash != nullptr) {
       auto truncation_mark = serialized_message_length;
diff --git a/src/lib/tls/tls13_pqc/hybrid_public_key.cpp b/src/lib/tls/tls13_pqc/hybrid_public_key.cpp
index b11ca892d8d..4d65f5466bf 100644
--- a/src/lib/tls/tls13_pqc/hybrid_public_key.cpp
+++ b/src/lib/tls/tls13_pqc/hybrid_public_key.cpp
@@ -163,7 +163,7 @@ std::vector<std::unique_ptr<Private_Key>> convert_kex_to_kem_sks(std::vector<std
       BOTAN_ARG_CHECK(key != nullptr, "Private key list contains a nullptr");
       if(key->supports_operation(PublicKeyOperation::KeyAgreement) &&
          !key->supports_operation(PublicKeyOperation::KeyEncapsulation)) {
-         auto ka_key = dynamic_cast<PK_Key_Agreement_Key*>(key.get());
+         auto* ka_key = dynamic_cast<PK_Key_Agreement_Key*>(key.get());
          BOTAN_ASSERT_NONNULL(ka_key);
          (void)key.release();
          return std::make_unique<KEX_to_KEM_Adapter_PrivateKey>(std::unique_ptr<PK_Key_Agreement_Key>(ka_key));
diff --git a/src/lib/tls/tls_session.cpp b/src/lib/tls/tls_session.cpp
index 83d800d7473..4448c1525fe 100644
--- a/src/lib/tls/tls_session.cpp
+++ b/src/lib/tls/tls_session.cpp
@@ -178,13 +178,13 @@ Session_Summary::Session_Summary(const Server_Hello_13& server_hello,
 
    std::optional<Named_Group> group = [&]() -> std::optional<Named_Group> {
       if(psk_used() || was_resumption()) {
-         if(const auto keyshare = server_hello.extensions().get<Key_Share>()) {
+         if(auto* const keyshare = server_hello.extensions().get<Key_Share>()) {
             return keyshare->selected_group();
          } else {
             return {};
          }
       } else {
-         const auto keyshare = server_hello.extensions().get<Key_Share>();
+         auto* const keyshare = server_hello.extensions().get<Key_Share>();
          BOTAN_ASSERT_NONNULL(keyshare);
          return keyshare->selected_group();
       }
@@ -479,10 +479,10 @@ Session Session::decrypt(std::span<const uint8_t> in, const SymmetricKey& key) {
       }
 
       BufferSlicer sub(in);
-      const auto magic = sub.take(TLS_SESSION_CRYPT_MAGIC_LEN).data();
-      const auto key_name = sub.take(TLS_SESSION_CRYPT_KEY_NAME_LEN).data();
-      const auto key_seed = sub.take(TLS_SESSION_CRYPT_AEAD_KEY_SEED_LEN).data();
-      const auto aead_nonce = sub.take(TLS_SESSION_CRYPT_AEAD_NONCE_LEN).data();
+      const auto* const magic = sub.take(TLS_SESSION_CRYPT_MAGIC_LEN).data();
+      const auto* const key_name = sub.take(TLS_SESSION_CRYPT_KEY_NAME_LEN).data();
+      const auto* const key_seed = sub.take(TLS_SESSION_CRYPT_AEAD_KEY_SEED_LEN).data();
+      const auto* const aead_nonce = sub.take(TLS_SESSION_CRYPT_AEAD_NONCE_LEN).data();
       auto ctext = sub.copy_as_secure_vector(sub.remaining());
 
       if(load_be<uint64_t>(magic, 0) != TLS_SESSION_CRYPT_MAGIC) {
diff --git a/src/lib/utils/mem_pool/mem_pool.cpp b/src/lib/utils/mem_pool/mem_pool.cpp
index bb1bfea5de5..0615220d57b 100644
--- a/src/lib/utils/mem_pool/mem_pool.cpp
+++ b/src/lib/utils/mem_pool/mem_pool.cpp
@@ -296,7 +296,7 @@ Memory_Pool::Memory_Pool(const std::vector<void*>& pages, size_t page_size) : m_
    m_min_page_ptr = ~static_cast<uintptr_t>(0);
    m_max_page_ptr = 0;
 
-   for(auto page : pages) {
+   for(auto* page : pages) {
       const uintptr_t p = reinterpret_cast<uintptr_t>(page);
 
       m_min_page_ptr = std::min(p, m_min_page_ptr);
diff --git a/src/lib/utils/parsing.cpp b/src/lib/utils/parsing.cpp
index ba0f54cc443..f2e6a5510e7 100644
--- a/src/lib/utils/parsing.cpp
+++ b/src/lib/utils/parsing.cpp
@@ -115,14 +115,14 @@ std::vector<std::string> split_on(std::string_view str, char delim) {
    }
 
    std::string substr;
-   for(auto i = str.begin(); i != str.end(); ++i) {
-      if(*i == delim) {
+   for(char c : str) {
+      if(c == delim) {
          if(!substr.empty()) {
             elems.push_back(substr);
          }
          substr.clear();
       } else {
-         substr += *i;
+         substr += c;
       }
    }
 
diff --git a/src/lib/x509/crl_ent.cpp b/src/lib/x509/crl_ent.cpp
index e134be0b837..3eca60146c5 100644
--- a/src/lib/x509/crl_ent.cpp
+++ b/src/lib/x509/crl_ent.cpp
@@ -112,7 +112,7 @@ void CRL_Entry::decode_from(BER_Decoder& source) {
 
    if(entry.more_items()) {
       entry.decode(data->m_extensions);
-      if(auto ext = data->m_extensions.get_extension_object_as<Cert_Extension::CRL_ReasonCode>()) {
+      if(const auto* ext = data->m_extensions.get_extension_object_as<Cert_Extension::CRL_ReasonCode>()) {
          data->m_reason = ext->get_reason();
       } else {
          data->m_reason = CRL_Code::Unspecified;
diff --git a/src/lib/x509/pkcs10.cpp b/src/lib/x509/pkcs10.cpp
index 67565be05b3..2740ae3c24d 100644
--- a/src/lib/x509/pkcs10.cpp
+++ b/src/lib/x509/pkcs10.cpp
@@ -145,7 +145,7 @@ std::unique_ptr<PKCS10_Data> decode_pkcs10(const std::vector<uint8_t>& body) {
 
    cert_req_info.verify_end();
 
-   if(auto ext = data->m_extensions.get_extension_object_as<Cert_Extension::Subject_Alternative_Name>()) {
+   if(const auto* ext = data->m_extensions.get_extension_object_as<Cert_Extension::Subject_Alternative_Name>()) {
       data->m_alt_name = ext->get_alt_name();
    }
 
diff --git a/src/lib/x509/x509_crl.cpp b/src/lib/x509/x509_crl.cpp
index f583ccaf0a3..255d7b96509 100644
--- a/src/lib/x509/x509_crl.cpp
+++ b/src/lib/x509/x509_crl.cpp
@@ -167,13 +167,13 @@ std::unique_ptr<CRL_Data> decode_crl_body(const std::vector<uint8_t>& body, cons
    tbs_crl.verify_end();
 
    // Now cache some fields from the extensions
-   if(auto ext = data->m_extensions.get_extension_object_as<Cert_Extension::CRL_Number>()) {
+   if(const auto* ext = data->m_extensions.get_extension_object_as<Cert_Extension::CRL_Number>()) {
       data->m_crl_number = ext->get_crl_number();
    }
-   if(auto ext = data->m_extensions.get_extension_object_as<Cert_Extension::Authority_Key_ID>()) {
+   if(const auto* ext = data->m_extensions.get_extension_object_as<Cert_Extension::Authority_Key_ID>()) {
       data->m_auth_key_id = ext->get_key_id();
    }
-   if(auto ext = data->m_extensions.get_extension_object_as<Cert_Extension::CRL_Issuing_Distribution_Point>()) {
+   if(const auto* ext = data->m_extensions.get_extension_object_as<Cert_Extension::CRL_Issuing_Distribution_Point>()) {
       data->m_idp_urls = ext->get_point().get_attribute("URL");
    }
 
diff --git a/src/lib/x509/x509_dn.cpp b/src/lib/x509/x509_dn.cpp
index eef0b9876b5..e6a81ce820b 100644
--- a/src/lib/x509/x509_dn.cpp
+++ b/src/lib/x509/x509_dn.cpp
@@ -34,8 +34,9 @@ bool is_space(char c) {
 * X.500 String Comparison
 */
 bool x500_name_cmp(std::string_view name1, std::string_view name2) {
-   auto p1 = name1.begin();
-   auto p2 = name2.begin();
+   // MSVC uses an actual iterator type for string_view, so we must use plain `auto` here
+   auto p1 = name1.begin();  // NOLINT(readability-qualified-auto)
+   auto p2 = name2.begin();  // NOLINT(readability-qualified-auto)
 
    while((p1 != name1.end()) && is_space(*p1)) {
       ++p1;
@@ -112,7 +113,7 @@ void X509_DN::add_attribute(const OID& oid, const ASN1_String& str) {
 std::multimap<OID, std::string> X509_DN::get_attributes() const {
    std::multimap<OID, std::string> retval;
 
-   for(auto& i : m_rdn) {
+   for(const auto& i : m_rdn) {
       retval.emplace(i.first, i.second.value());
    }
    return retval;
@@ -124,7 +125,7 @@ std::multimap<OID, std::string> X509_DN::get_attributes() const {
 std::multimap<std::string, std::string> X509_DN::contents() const {
    std::multimap<std::string, std::string> retval;
 
-   for(auto& i : m_rdn) {
+   for(const auto& i : m_rdn) {
       retval.emplace(i.first.to_formatted_string(), i.second.value());
    }
    return retval;
@@ -142,7 +143,7 @@ bool X509_DN::has_field(std::string_view attr) const {
 }
 
 bool X509_DN::has_field(const OID& oid) const {
-   for(auto& i : m_rdn) {
+   for(const auto& i : m_rdn) {
       if(i.first == oid) {
          return true;
       }
@@ -157,7 +158,7 @@ std::string X509_DN::get_first_attribute(std::string_view attr) const {
 }
 
 ASN1_String X509_DN::get_first_attribute(const OID& oid) const {
-   for(auto& i : m_rdn) {
+   for(const auto& i : m_rdn) {
       if(i.first == oid) {
          return i.second;
       }
@@ -174,7 +175,7 @@ std::vector<std::string> X509_DN::get_attribute(std::string_view attr) const {
 
    std::vector<std::string> values;
 
-   for(auto& i : m_rdn) {
+   for(const auto& i : m_rdn) {
       if(i.first == oid) {
          values.push_back(i.second.value());
       }
diff --git a/src/lib/x509/x509cert.cpp b/src/lib/x509/x509cert.cpp
index a65a1147373..058be9866dd 100644
--- a/src/lib/x509/x509cert.cpp
+++ b/src/lib/x509/x509cert.cpp
@@ -158,7 +158,7 @@ std::unique_ptr<X509_Certificate_Data> parse_x509_cert_body(const X509_Object& o
    }
 
    // Now cache some fields from the extensions
-   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Key_Usage>()) {
+   if(const auto* ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Key_Usage>()) {
       data->m_key_constraints = ext->get_constraints();
       /*
       RFC 5280: When the keyUsage extension appears in a certificate,
@@ -169,19 +169,19 @@ std::unique_ptr<X509_Certificate_Data> parse_x509_cert_body(const X509_Object& o
       }
    }
 
-   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Subject_Key_ID>()) {
+   if(const auto* ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Subject_Key_ID>()) {
       data->m_subject_key_id = ext->get_key_id();
    }
 
-   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Authority_Key_ID>()) {
+   if(const auto* ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Authority_Key_ID>()) {
       data->m_authority_key_id = ext->get_key_id();
    }
 
-   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Name_Constraints>()) {
+   if(const auto* ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Name_Constraints>()) {
       data->m_name_constraints = ext->get_name_constraints();
    }
 
-   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Extended_Key_Usage>()) {
+   if(const auto* ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Extended_Key_Usage>()) {
       data->m_extended_key_usage = ext->object_identifiers();
       /*
       RFC 5280 section 4.2.1.12
@@ -199,7 +199,7 @@ std::unique_ptr<X509_Certificate_Data> parse_x509_cert_body(const X509_Object& o
       }
    }
 
-   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Basic_Constraints>()) {
+   if(const auto* ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Basic_Constraints>()) {
       if(ext->get_is_ca() == true) {
          /*
          * RFC 5280 section 4.2.1.3 requires that CAs include KeyUsage in all
@@ -244,11 +244,11 @@ std::unique_ptr<X509_Certificate_Data> parse_x509_cert_body(const X509_Object& o
       }
    }
 
-   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Issuer_Alternative_Name>()) {
+   if(const auto* ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Issuer_Alternative_Name>()) {
       data->m_issuer_alt_name = ext->get_alt_name();
    }
 
-   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Subject_Alternative_Name>()) {
+   if(const auto* ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Subject_Alternative_Name>()) {
       data->m_subject_alt_name = ext->get_alt_name();
    }
 
@@ -258,16 +258,16 @@ std::unique_ptr<X509_Certificate_Data> parse_x509_cert_body(const X509_Object& o
    const auto san_oid = OID::from_string("X509v3.SubjectAlternativeName");
    data->m_subject_alt_name_exists = data->m_v3_extensions.extension_set(san_oid);
 
-   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Certificate_Policies>()) {
+   if(const auto* ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Certificate_Policies>()) {
       data->m_cert_policies = ext->get_policy_oids();
    }
 
-   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Authority_Information_Access>()) {
+   if(const auto* ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::Authority_Information_Access>()) {
       data->m_ocsp_responder = ext->ocsp_responder();
       data->m_ca_issuers = ext->ca_issuers();
    }
 
-   if(auto ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::CRL_Distribution_Points>()) {
+   if(const auto* ext = data->m_v3_extensions.get_extension_object_as<Cert_Extension::CRL_Distribution_Points>()) {
       data->m_crl_distribution_points = ext->crl_distribution_urls();
    }
 
diff --git a/src/lib/x509/x509path.cpp b/src/lib/x509/x509path.cpp
index 28bf1676dc4..5f80d177bec 100644
--- a/src/lib/x509/x509path.cpp
+++ b/src/lib/x509/x509path.cpp
@@ -203,7 +203,7 @@ CertificatePathStatusCodes PKIX::check_chain(const std::vector<X509_Certificate>
       if(subject.x509_version() < 3 && !extensions_vec.empty()) {
          status.insert(Certificate_Status_Code::EXT_IN_V1_V2_CERT);
       }
-      for(auto& extension : extensions_vec) {
+      for(const auto& extension : extensions_vec) {
          extension.first->validate(subject, issuer, cert_path, cert_status, i);
       }
       if(extensions_vec.size() != extensions.get_extension_oids().size()) {
@@ -444,7 +444,7 @@ CertificatePathStatusCodes PKIX::check_crl(const std::vector<X509_Certificate>&
    std::vector<std::optional<X509_CRL>> crls(cert_path.size());
 
    for(size_t i = 0; i != cert_path.size(); ++i) {
-      for(auto certstore : certstores) {
+      for(auto* certstore : certstores) {
          crls[i] = certstore->find_crl_for(cert_path[i]);
          if(crls[i]) {
             break;
@@ -536,7 +536,7 @@ CertificatePathStatusCodes PKIX::check_crl_online(const std::vector<X509_Certifi
 
    for(size_t i = 0; i != cert_path.size(); ++i) {
       const std::optional<X509_Certificate>& cert = cert_path.at(i);
-      for(auto certstore : certstores) {
+      for(auto* certstore : certstores) {
          crls[i] = certstore->find_crl_for(*cert);
          if(crls[i].has_value()) {
             break;
diff --git a/src/lib/x509/x509self.cpp b/src/lib/x509/x509self.cpp
index 934d01da739..23543a54ca2 100644
--- a/src/lib/x509/x509self.cpp
+++ b/src/lib/x509/x509self.cpp
@@ -49,7 +49,7 @@ auto create_alt_name_ext(const X509_Cert_Options& opts, const Extensions& extens
    If the extension was already created in opts.extension we need to
    merge the values provied in opts with the values set in the extension.
    */
-   if(auto ext = extensions.get_extension_object_as<Cert_Extension::Subject_Alternative_Name>()) {
+   if(const auto* ext = extensions.get_extension_object_as<Cert_Extension::Subject_Alternative_Name>()) {
       subject_alt = ext->get_alt_name();
    }
 
diff --git a/src/scripts/dev_tools/run_clang_tidy.py b/src/scripts/dev_tools/run_clang_tidy.py
index a32e15c9e2e..d989dced48c 100755
--- a/src/scripts/dev_tools/run_clang_tidy.py
+++ b/src/scripts/dev_tools/run_clang_tidy.py
@@ -45,6 +45,8 @@
 # these are ones that we might want to be clean for in the future,
 # but currently are not
 disabled_needs_work = [
+    'readability-qualified-auto', # almost cleared except test_x509_rpki.cpp
+
     '*-named-parameter',
     '*-member-init', # should definitely fix this one
     'bugprone-unchecked-optional-access', # clang-tidy seems buggy (many false positives)
@@ -64,7 +66,6 @@
     'readability-convert-member-functions-to-static',
     'readability-implicit-bool-conversion',
     'readability-inconsistent-declaration-parameter-name', # should fix this, blocked by https://github.com/llvm/llvm-project/issues/60845
-    'readability-qualified-auto',
     'readability-simplify-boolean-expr', # sometimes ok
     'readability-static-accessed-through-instance',
 ]
diff --git a/src/tests/test_ecdsa.cpp b/src/tests/test_ecdsa.cpp
index 259751e2571..23be75d464b 100644
--- a/src/tests/test_ecdsa.cpp
+++ b/src/tests/test_ecdsa.cpp
@@ -328,7 +328,7 @@ class ECDSA_ExplicitCurveKey_Test : public Text_Based_Test {
             const auto expected_oid = Botan::OID::from_name(group_name).value();
 
             auto key = Botan::PKCS8::load_key(key_bytes);
-            auto ecdsa = dynamic_cast<const Botan::ECDSA_PrivateKey*>(key.get());
+            const auto* ecdsa = dynamic_cast<const Botan::ECDSA_PrivateKey*>(key.get());
             if(ecdsa != nullptr) {
                result.test_success("Returned key was ECDSA");
             } else {
diff --git a/src/tests/test_ed448.cpp b/src/tests/test_ed448.cpp
index 799561f842f..6e3f5f71d6c 100644
--- a/src/tests/test_ed448.cpp
+++ b/src/tests/test_ed448.cpp
@@ -129,7 +129,7 @@ class Ed448_Utils_Test final : public Test {
          const std::vector<std::array<uint8_t, 114>> test_vectors = {
             full, std::array<uint8_t, 114>{0x42}, std::array<uint8_t, 114>{0}};
 
-         for(auto& t : test_vectors) {
+         for(const auto& t : test_vectors) {
             const auto ref = reduce_mod_L_ref(t);
             std::array<uint8_t, 56> res;
             result.test_no_throw("Reduce mod L does not throw", [&] { res = Botan::Scalar448(t).to_bytes<56>(); });
diff --git a/src/tests/test_ffi.cpp b/src/tests/test_ffi.cpp
index 2b08fa3c4a1..f9a28576b82 100644
--- a/src/tests/test_ffi.cpp
+++ b/src/tests/test_ffi.cpp
@@ -3455,7 +3455,7 @@ class FFI_KEM_Roundtrip_Test : public FFI_Test {
 
    public:
       void ffi_test(Test::Result& result, botan_rng_t rng) override {
-         for(auto mode : modes()) {
+         for(const auto* mode : modes()) {
             // generate a key pair
             botan_privkey_t priv;
             botan_pubkey_t pub;
@@ -3604,7 +3604,7 @@ class FFI_Signature_Roundtrip_Test : public FFI_Test {
          const std::vector<uint8_t> message1 = {'H', 'e', 'l', 'l', 'o', ' '};
          const std::vector<uint8_t> message2 = {'W', 'o', 'r', 'l', 'd', '!'};
 
-         for(auto mode : modes()) {
+         for(const auto* mode : modes()) {
             // generate a key pair
             botan_privkey_t priv;
             botan_pubkey_t pub;
diff --git a/src/tests/test_hss_lms.cpp b/src/tests/test_hss_lms.cpp
index 6c43c1d7a91..6dad618add5 100644
--- a/src/tests/test_hss_lms.cpp
+++ b/src/tests/test_hss_lms.cpp
@@ -31,7 +31,7 @@ std::vector<Test::Result> test_hss_lms_params_parsing() {
                   Botan::HSS_LMS_Params hss_params("SHA-256,HW(5,1),HW(25,8)");
 
                   result.test_is_eq("hss levels", hss_params.L(), Botan::HSS_Level(2));
-                  auto& top_lms_params = hss_params.params_at_level(Botan::HSS_Level(0));
+                  const auto& top_lms_params = hss_params.params_at_level(Botan::HSS_Level(0));
                   result.test_is_eq("hash name", top_lms_params.lms_params().hash_name(), std::string("SHA-256"));
                   result.test_is_eq("top level - lms type",
                                     top_lms_params.lms_params().algorithm_type(),
@@ -40,7 +40,7 @@ std::vector<Test::Result> test_hss_lms_params_parsing() {
                                     top_lms_params.lmots_params().algorithm_type(),
                                     Botan::LMOTS_Algorithm_Type::SHA256_N32_W1);
 
-                  auto& second_lms_params = hss_params.params_at_level(Botan::HSS_Level(1));
+                  const auto& second_lms_params = hss_params.params_at_level(Botan::HSS_Level(1));
                   result.test_is_eq("2nd level - lms type",
                                     second_lms_params.lms_params().algorithm_type(),
                                     Botan::LMS_Algorithm_Type::SHA256_M32_H25);
diff --git a/src/tests/test_strong_type.cpp b/src/tests/test_strong_type.cpp
index 4a6d22972b7..486c428b118 100644
--- a/src/tests/test_strong_type.cpp
+++ b/src/tests/test_strong_type.cpp
@@ -100,7 +100,7 @@ std::vector<Test::Result> test_container_strong_type() {
       CHECK("behaves like a standard container",
             [](auto& result) {
                auto base_nonce = Botan::hex_decode("DEADBEEF");
-               auto dataptr = base_nonce.data();
+               auto* dataptr = base_nonce.data();
                auto nonce = Test_Nonce(std::move(base_nonce));
 
                result.test_is_eq("size()", nonce.size(), size_t(4));
@@ -566,7 +566,7 @@ std::vector<Test::Result> test_wrapping_unwrapping() {
                const Strong_String const_stt("wrapped const lvalue");
 
                auto& unwrapped_stt = Botan::unwrap_strong_type(stt);
-               auto& unwrapped_const_stt = Botan::unwrap_strong_type(const_stt);
+               const auto& unwrapped_const_stt = Botan::unwrap_strong_type(const_stt);
                auto unwrapped_rvalue = Botan::unwrap_strong_type(std::move(stt_move));
                auto unwrapped_rvalue2 = Botan::unwrap_strong_type(Strong_String("wrapped rvalue"));
 
@@ -595,7 +595,7 @@ std::vector<Test::Result> test_wrapping_unwrapping() {
                const std::string const_stt("wrapped const lvalue");
 
                auto& unwrapped_stt = Botan::unwrap_strong_type(stt);
-               auto& unwrapped_const_stt = Botan::unwrap_strong_type(const_stt);
+               const auto& unwrapped_const_stt = Botan::unwrap_strong_type(const_stt);
                auto unwrapped_rvalue = Botan::unwrap_strong_type(std::move(stt_move));
                auto unwrapped_rvalue2 = Botan::unwrap_strong_type(std::string("wrapped rvalue"));
 
diff --git a/src/tests/test_tls_cipher_state.cpp b/src/tests/test_tls_cipher_state.cpp
index 133a05bced7..37ec1a20d94 100644
--- a/src/tests/test_tls_cipher_state.cpp
+++ b/src/tests/test_tls_cipher_state.cpp
@@ -477,9 +477,9 @@ std::vector<Test::Result> test_secret_derivation_rfc8448_rtt1() {
 
        CHECK_both("key update",
                   [&](Cipher_State* cs, Journaling_Secret_Logger* sl, Connection_Side side, Test::Result& result) {
-                     const auto read_label =
+                     const auto* const read_label =
                         side == Connection_Side::Client ? "SERVER_TRAFFIC_SECRET_1" : "CLIENT_TRAFFIC_SECRET_1";
-                     const auto write_label =
+                     const auto* const write_label =
                         side == Connection_Side::Client ? "CLIENT_TRAFFIC_SECRET_1" : "SERVER_TRAFFIC_SECRET_1";
 
                      cs->update_read_keys(*sl);
diff --git a/src/tests/test_tls_hybrid_kem_key.cpp b/src/tests/test_tls_hybrid_kem_key.cpp
index 0a1c5640c28..25753938645 100644
--- a/src/tests/test_tls_hybrid_kem_key.cpp
+++ b/src/tests/test_tls_hybrid_kem_key.cpp
@@ -39,7 +39,7 @@ std::unique_ptr<Botan::Private_Key> kem() {
 std::unique_ptr<Botan::PK_Key_Agreement_Key> kex_dh() {
    static auto kex_key = Botan::create_private_key("DH", global_test_rng(), "ffdhe/ietf/2048");
    auto sk = Botan::load_private_key(kex_key->algorithm_identifier(), kex_key->private_key_bits());
-   auto kex_sk = dynamic_cast<Botan::PK_Key_Agreement_Key*>(sk.get());
+   auto* kex_sk = dynamic_cast<Botan::PK_Key_Agreement_Key*>(sk.get());
    if(kex_sk != nullptr) {
       // NOLINTNEXTLINE(bugprone-unused-return-value)
       (void)sk.release();
@@ -52,7 +52,7 @@ std::unique_ptr<Botan::PK_Key_Agreement_Key> kex_dh() {
 std::unique_ptr<Botan::PK_Key_Agreement_Key> kex_ecdh() {
    static auto kex_key = Botan::create_private_key("ECDH", global_test_rng(), "secp256r1");
    auto sk = Botan::load_private_key(kex_key->algorithm_identifier(), kex_key->private_key_bits());
-   auto kex_sk = dynamic_cast<Botan::PK_Key_Agreement_Key*>(sk.get());
+   auto* kex_sk = dynamic_cast<Botan::PK_Key_Agreement_Key*>(sk.get());
    if(kex_sk != nullptr) {
       // NOLINTNEXTLINE(bugprone-unused-return-value)
       (void)sk.release();
diff --git a/src/tests/test_xmss.cpp b/src/tests/test_xmss.cpp
index 6d1b76011ec..7ed1d47dc75 100644
--- a/src/tests/test_xmss.cpp
+++ b/src/tests/test_xmss.cpp
@@ -279,7 +279,7 @@ std::vector<Test::Result> xmss_legacy_private_key() {
    Botan::XMSS_PublicKey legacy_public_key = Botan::XMSS_PublicKey(legacy_xmss_public_key);
 
    const auto message = Botan::hex_decode("deadcafe");
-   const auto algo_name = "SHA2_10_256";
+   const auto* const algo_name = "SHA2_10_256";
 
    auto rng = Test::new_rng(__func__);
 
diff --git a/src/tests/tests.cpp b/src/tests/tests.cpp
index 7f96e1393ea..e76ddc7f862 100644
--- a/src/tests/tests.cpp
+++ b/src/tests/tests.cpp
@@ -1202,7 +1202,7 @@ std::vector<Test::Result> Text_Based_Test::run() {
 
       if(key == m_output_key) {
          try {
-            for(auto& req_key : m_required_keys) {
+            for(const auto& req_key : m_required_keys) {
                if(!vars.has_key(req_key)) {
                   auto r =
                      Test::Result::Failure(header_or_name, Botan::fmt("{} missing required key {}", test_id, req_key));
diff --git a/src/tests/unit_x509.cpp b/src/tests/unit_x509.cpp
index 978907793e6..5b7a041b4d1 100644
--- a/src/tests/unit_x509.cpp
+++ b/src/tests/unit_x509.cpp
@@ -1437,7 +1437,7 @@ Test::Result test_x509_extensions(const Botan::Private_Key& ca_key,
    }
 
    // check if CDPs are present in the self-signed cert
-   auto cert_cdps =
+   const auto* cert_cdps =
       self_signed_cert.v3_extensions().get_extension_object_as<Botan::Cert_Extension::CRL_Distribution_Points>();
 
    if(result.confirm("CRL Distribution Points extension present in self-signed certificate",
@@ -1564,9 +1564,9 @@ Test::Result test_x509_tn_auth_list_extension_decode() {
 
    using Botan::Cert_Extension::TNAuthList;
 
-   auto tn_auth_list = cert.v3_extensions().get_extension_object_as<TNAuthList>();
+   const auto* tn_auth_list = cert.v3_extensions().get_extension_object_as<TNAuthList>();
 
-   auto& tn_entries = tn_auth_list->entries();
+   const auto& tn_entries = tn_auth_list->entries();
 
    result.confirm("cert has TNAuthList extension", tn_auth_list != nullptr, true);
 
@@ -1581,7 +1581,7 @@ Test::Result test_x509_tn_auth_list_extension_decode() {
    result.test_eq("spc entry data", tn_entries[0].service_provider_code(), "1001");
 
    result.test_eq("range entry type", tn_entries[1].type() == TNAuthList::Entry::TelephoneNumberRange, true);
-   auto& range = tn_entries[1].telephone_number_range();
+   const auto& range = tn_entries[1].telephone_number_range();
    result.test_eq("range entries count", range.size(), 2);
    result.test_eq("range entry 0 start data", range[0].start.value(), "111");
    result.test_eq("range entry 0 count data", range[0].count, 128);