diff --git a/include/sudo_compat.h b/include/sudo_compat.h
index 9b71ea73e..c7181820a 100644
--- a/include/sudo_compat.h
+++ b/include/sudo_compat.h
@@ -342,7 +342,7 @@ sudo_dso_public int sudo_getgrouplist(const char *name, GETGROUPS_T basegid, GET
 # define getgrouplist(_a, _b, _c, _d) sudo_getgrouplist((_a), (_b), (_c), (_d))
 #endif /* GETGROUPLIST */
 #if !defined(HAVE_GETDELIM)
-sudo_dso_public ssize_t sudo_getdelim(char **bufp, size_t *bufsizep, int delim, FILE *fp);
+sudo_dso_public ssize_t sudo_getdelim(char ** restrict bufp, size_t * restrict bufsizep, int delim, FILE * restrict fp);
 # undef getdelim
 # define getdelim(_a, _b, _c, _d) sudo_getdelim((_a), (_b), (_c), (_d))
 #elif defined(HAVE_DECL_GETDELIM) && !HAVE_DECL_GETDELIM
@@ -533,7 +533,7 @@ sudo_dso_public void *sudo_reallocarray(void *ptr, size_t nmemb, size_t size);
 # define reallocarray(_a, _b, _c) sudo_reallocarray((_a), (_b), (_c))
 #endif /* HAVE_REALLOCARRAY */
 #ifndef HAVE_REALPATH
-sudo_dso_public char *sudo_realpath(const char *path, char *resolved);
+sudo_dso_public char *sudo_realpath(const char * restrict path, char * restrict resolved);
 # undef realpath
 # define realpath(_a, _b) sudo_realpath((_a), (_b))
 #endif /* HAVE_REALPATH */
diff --git a/lib/util/getdelim.c b/lib/util/getdelim.c
index 7984fb5a3..1c957052c 100644
--- a/lib/util/getdelim.c
+++ b/lib/util/getdelim.c
@@ -33,7 +33,8 @@
 #include <sudo_compat.h>
 
 ssize_t
-sudo_getdelim(char **buf, size_t *bufsize, int delim, FILE *fp)
+sudo_getdelim(char ** restrict buf, size_t * restrict bufsize, int delim,
+    FILE * restrict fp)
 {
     char *cp, *ep;
     int ch;
diff --git a/lib/util/realpath.c b/lib/util/realpath.c
index fe0f061f0..9e945af75 100644
--- a/lib/util/realpath.c
+++ b/lib/util/realpath.c
@@ -53,7 +53,7 @@
  * in which case the path which caused trouble is left in (resolved).
  */
 char *
-sudo_realpath(const char *path, char *resolved)
+sudo_realpath(const char * restrict path, char * restrict resolved)
 {
 	struct stat sb;
 	int idx = 0, nlnk = 0;
diff --git a/lib/util/regress/getdelim/getdelim_test.c b/lib/util/regress/getdelim/getdelim_test.c
index 091f6c130..31548ccad 100644
--- a/lib/util/regress/getdelim/getdelim_test.c
+++ b/lib/util/regress/getdelim/getdelim_test.c
@@ -38,7 +38,8 @@
 
 sudo_dso_public int main(int argc, char *argv[]);
 
-ssize_t sudo_getdelim(char **bufp, size_t *bufsizep, int delim, FILE *fp);
+ssize_t sudo_getdelim(char ** restrict bufp, size_t * restrict bufsizep,
+    int delim, FILE * restrict fp);
 
 /*
  * Test that sudo_getdelim() works as expected.
diff --git a/plugins/sudoers/toke.c b/plugins/sudoers/toke.c
index c24a26777..a60f6322e 100644
--- a/plugins/sudoers/toke.c
+++ b/plugins/sudoers/toke.c
@@ -5897,7 +5897,8 @@ init_lexer(void)
  * Like strlcpy() but expand %h escapes.
  */
 static size_t
-strlcpy_expand_host(char *dst, const char *src, const char *host, size_t size)
+strlcpy_expand_host(char * restrict dst, const char * restrict src,
+    const char * restrict host, size_t size)
 {
     size_t len = 0;
     char ch;
diff --git a/plugins/sudoers/toke.l b/plugins/sudoers/toke.l
index fa117acb9..1fa97491e 100644
--- a/plugins/sudoers/toke.l
+++ b/plugins/sudoers/toke.l
@@ -1118,7 +1118,8 @@ init_lexer(void)
  * Like strlcpy() but expand %h escapes.
  */
 static size_t
-strlcpy_expand_host(char *dst, const char *src, const char *host, size_t size)
+strlcpy_expand_host(char * restrict dst, const char * restrict src,
+    const char * restrict host, size_t size)
 {
     size_t len = 0;
     char ch;