diff --git a/include/security/pam_appl.h b/include/security/pam_appl.h
index 2aed200..760890e 100644
--- a/include/security/pam_appl.h
+++ b/include/security/pam_appl.h
@@ -72,11 +72,11 @@ pam_get_data(pam_handle_t *_pamh,
 int
 pam_get_item(pam_handle_t *_pamh,
 	int _item_type,
-	void **_item);
+	const void **_item);
 
 int
 pam_get_user(pam_handle_t *_pamh,
-	char **_user,
+	const char **_user,
 	const char *_prompt);
 
 char *
@@ -131,7 +131,7 @@ pam_error(pam_handle_t *_pamh,
 
 int
 pam_get_authtok(pam_handle_t *_pamh,
-	char **_authtok,
+	const char **_authtok,
 	const char *_prompt);
 
 int
diff --git a/lib/pam_get_authtok.c b/lib/pam_get_authtok.c
index 1317d55..b017936 100644
--- a/lib/pam_get_authtok.c
+++ b/lib/pam_get_authtok.c
@@ -48,25 +48,26 @@
 
 int
 pam_get_authtok(pam_handle_t *pamh,
-	char **authtok,
+	const char **authtok,
 	const char *prompt)
 {
-	char *p;
+	char *p, *resp;
 	int r;
 
 	if (pamh == NULL || authtok == NULL)
 		return (PAM_SYSTEM_ERR);
 
-	r = pam_get_item(pamh, PAM_AUTHTOK, (void **)authtok);
+	r = pam_get_item(pamh, PAM_AUTHTOK, (const void **)authtok);
 	if (r == PAM_SUCCESS)
 		return (PAM_SUCCESS);
 	if (prompt == NULL) {
-		if (pam_get_item(pamh, PAM_AUTHTOK_PROMPT, (void **)&p) !=
-		    PAM_SUCCESS || p == NULL)
+		if (pam_get_item(pamh, PAM_AUTHTOK_PROMPT,
+		    (const void **)&p) != PAM_SUCCESS || p == NULL)
 			prompt = "Password:";
 	}
-	r = pam_prompt(pamh, authtok, 0, "%s", prompt ? prompt : p);
+	r = pam_prompt(pamh, &resp, 0, "%s", prompt ? prompt : p);
 	if (r != PAM_SUCCESS)
 		return (r);
+	*authtok = resp;
 	return (pam_set_item(pamh, PAM_AUTHTOK, *authtok));
 }
diff --git a/lib/pam_get_item.c b/lib/pam_get_item.c
index 636aa47..7369c48 100644
--- a/lib/pam_get_item.c
+++ b/lib/pam_get_item.c
@@ -50,7 +50,7 @@
 int
 pam_get_item(pam_handle_t *pamh,
 	int item_type,
-	void **item)
+	const void **item)
 {
 	if (pamh == NULL)
 		return (PAM_SYSTEM_ERR);