diff --git a/crypto/fipsmodule/evp/evp_ctx.c b/crypto/fipsmodule/evp/evp_ctx.c
index 149c11bd79..5ca42873c9 100644
--- a/crypto/fipsmodule/evp/evp_ctx.c
+++ b/crypto/fipsmodule/evp/evp_ctx.c
@@ -587,7 +587,7 @@ int EVP_PKEY_encapsulate(EVP_PKEY_CTX *ctx,
 
 int EVP_PKEY_decapsulate(EVP_PKEY_CTX *ctx,
                          uint8_t *shared_secret, size_t *shared_secret_len,
-                         uint8_t *ciphertext, size_t ciphertext_len) {
+                         const uint8_t *ciphertext, size_t ciphertext_len) {
   if (ctx == NULL || ctx->pmeth == NULL || ctx->pmeth->decapsulate == NULL) {
       OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
       return 0;
diff --git a/include/openssl/evp.h b/include/openssl/evp.h
index 9be4ea6aa6..eea831786f 100644
--- a/include/openssl/evp.h
+++ b/include/openssl/evp.h
@@ -763,7 +763,7 @@ OPENSSL_EXPORT int EVP_PKEY_encapsulate(EVP_PKEY_CTX *ctx          /* IN  */,
 OPENSSL_EXPORT int EVP_PKEY_decapsulate(EVP_PKEY_CTX *ctx          /* IN  */,
                                         uint8_t *shared_secret     /* OUT */,
                                         size_t  *shared_secret_len /* OUT */,
-                                        uint8_t *ciphertext        /* IN  */,
+                                        const uint8_t *ciphertext  /* IN  */,
                                         size_t   ciphertext_len    /* IN  */);
 
 // EVP_PKEY_paramgen_init initialises an |EVP_PKEY_CTX| for a parameter