diff --git a/pdns/dnsdist-lua-actions.cc b/pdns/dnsdist-lua-actions.cc
index 22229b6dcb75..22077fcf34a3 100644
--- a/pdns/dnsdist-lua-actions.cc
+++ b/pdns/dnsdist-lua-actions.cc
@@ -327,8 +327,10 @@ class PoolAction : public DNSAction
   }
 
 private:
-  std::string d_pool;
-  bool d_stopProcessing;
+  // NOLINTNEXTLINE(cppcoreguidelines-avoid-const-or-ref-data-members)
+  const std::string d_pool;
+  // NOLINTNEXTLINE(cppcoreguidelines-avoid-const-or-ref-data-members)
+  const bool d_stopProcessing;
 };
 
 class QPSPoolAction : public DNSAction
@@ -355,8 +357,10 @@ class QPSPoolAction : public DNSAction
 
 private:
   mutable LockGuarded<QPSLimiter> d_qps;
-  std::string d_pool;
-  bool d_stopProcessing;
+  // NOLINTNEXTLINE(cppcoreguidelines-avoid-const-or-ref-data-members)
+  const std::string d_pool;
+  // NOLINTNEXTLINE(cppcoreguidelines-avoid-const-or-ref-data-members)
+  const bool d_stopProcessing;
 };
 
 class RCodeAction : public DNSAction
@@ -747,8 +751,10 @@ class LuaFFIPerThreadAction : public DNSAction
   };
   static std::atomic<uint64_t> s_functionsCounter;
   static thread_local std::map<uint64_t, PerThreadState> t_perThreadStates;
-  std::string d_functionCode;
-  uint64_t d_functionID;
+  // NOLINTNEXTLINE(cppcoreguidelines-avoid-const-or-ref-data-members)
+  const std::string d_functionCode;
+  // NOLINTNEXTLINE(cppcoreguidelines-avoid-const-or-ref-data-members)
+  const uint64_t d_functionID;
 };
 
 std::atomic<uint64_t> LuaFFIPerThreadAction::s_functionsCounter = 0;
@@ -869,8 +875,10 @@ class LuaFFIPerThreadResponseAction : public DNSResponseAction
 
   static std::atomic<uint64_t> s_functionsCounter;
   static thread_local std::map<uint64_t, PerThreadState> t_perThreadStates;
-  std::string d_functionCode;
-  uint64_t d_functionID;
+  // NOLINTNEXTLINE(cppcoreguidelines-avoid-const-or-ref-data-members)
+  const std::string d_functionCode;
+  // NOLINTNEXTLINE(cppcoreguidelines-avoid-const-or-ref-data-members)
+  const uint64_t d_functionID;
 };
 
 std::atomic<uint64_t> LuaFFIPerThreadResponseAction::s_functionsCounter = 0;
diff --git a/pdns/dnsdist-protobuf.hh b/pdns/dnsdist-protobuf.hh
index 86ec100331fc..c2dee817daf3 100644
--- a/pdns/dnsdist-protobuf.hh
+++ b/pdns/dnsdist-protobuf.hh
@@ -87,7 +87,6 @@ private:
   };
   std::unordered_map<std::string, MetaValue> d_metaTags;
 
-  // FIXME wondering if the cost of moving to a shared_ptr would be that bad
   // NOLINTNEXTLINE(cppcoreguidelines-avoid-const-or-ref-data-members)
   const DNSQuestion& d_dq;
   const DNSResponse* d_dr{nullptr};
@@ -127,9 +126,12 @@ class ProtoBufMetaKey
 
   struct KeyTypeDescription
   {
-    std::string d_name;
-    Type d_type;
-    std::function<std::vector<std::string>(const DNSQuestion&, const std::string&, uint8_t)> d_func;
+    // NOLINTNEXTLINE(cppcoreguidelines-avoid-const-or-ref-data-members)
+    const std::string d_name;
+    // NOLINTNEXTLINE(cppcoreguidelines-avoid-const-or-ref-data-members)
+    const Type d_type;
+    // NOLINTNEXTLINE(cppcoreguidelines-avoid-const-or-ref-data-members)
+    const std::function<std::vector<std::string>(const DNSQuestion&, const std::string&, uint8_t)> d_func;
     bool d_prefix{false};
     bool d_caseSensitive{true};
     bool d_numeric{false};
diff --git a/pdns/dnsname.cc b/pdns/dnsname.cc
index 21008f38fedd..25a90078a890 100644
--- a/pdns/dnsname.cc
+++ b/pdns/dnsname.cc
@@ -100,7 +100,7 @@ DNSName::DNSName(const std::string_view sw)
 }
 
 
-DNSName::DNSName(const char* pos, size_t len, size_t offset, bool uncompress, uint16_t* qtype, uint16_t* qclass, unsigned int* consumed, uint16_t minOffset)
+DNSName::DNSName(const char* pos, int len, int offset, bool uncompress, uint16_t* qtype, uint16_t* qclass, unsigned int* consumed, uint16_t minOffset)
 {
   if (offset >= len)
     throw std::range_error("Trying to read past the end of the buffer ("+std::to_string(offset)+ " >= "+std::to_string(len)+")");
diff --git a/pdns/dnsname.hh b/pdns/dnsname.hh
index dbdc2ac2c3c2..9b9692f51e23 100644
--- a/pdns/dnsname.hh
+++ b/pdns/dnsname.hh
@@ -100,7 +100,7 @@ public:
   DNSName(DNSName&& a) = default;
 
   explicit DNSName(std::string_view sw); //!< Constructs from a human formatted, escaped presentation
-  DNSName(const char* pos, size_t len, size_t offset, bool uncompress, uint16_t* qtype = nullptr, uint16_t* qclass = nullptr, unsigned int* consumed = nullptr, uint16_t minOffset = 0); //!< Construct from a DNS Packet, taking the first question if offset=12. If supplied, consumed is set to the number of bytes consumed from the packet, which will not be equal to the wire length of the resulting name in case of compression.
+  DNSName(const char* p, int len, int offset, bool uncompress, uint16_t* qtype = nullptr, uint16_t* qclass = nullptr, unsigned int* consumed = nullptr, uint16_t minOffset = 0); //!< Construct from a DNS Packet, taking the first question if offset=12. If supplied, consumed is set to the number of bytes consumed from the packet, which will not be equal to the wire length of the resulting name in case of compression.
 
   bool isPartOf(const DNSName& rhs) const;   //!< Are we part of the rhs name? Note that name.isPartOf(name).
   inline bool operator==(const DNSName& rhs) const; //!< DNS-native comparison (case insensitive) - empty compares to empty