diff --git a/host/commands/secure_env/tpm_hmac.cpp b/host/commands/secure_env/tpm_hmac.cpp
index 6273661..f7c1565 100644
--- a/host/commands/secure_env/tpm_hmac.cpp
+++ b/host/commands/secure_env/tpm_hmac.cpp
@@ -25,7 +25,7 @@
     TpmResourceManager* resource_manager,
     ESYS_TR key_handle,
     TpmAuth auth,
-    uint8_t* data,
+    const uint8_t* data,
     size_t data_size) {
   if (data_size  > TPM2_MAX_DIGEST_BUFFER) {
     LOG(ERROR) << "Logic error: OneshotSign called with data_size "
@@ -62,7 +62,7 @@
     TpmResourceManager* resource_manager,
     ESYS_TR key_handle,
     TpmAuth key_auth,
-    uint8_t* data,
+    const uint8_t* data,
     size_t data_size) {
   // TODO(schuffelen): Pipeline commands where possible.
   TPM2B_AUTH sequence_auth;
@@ -148,7 +148,7 @@
     TpmResourceManager* resource_manager,
     ESYS_TR key_handle,
     TpmAuth auth,
-    uint8_t* data,
+    const uint8_t* data,
     size_t data_size) {
   auto fn = data_size > TPM2_MAX_DIGEST_BUFFER ? SegmentedHmac : OneshotHmac;
   return fn(resource_manager, key_handle, auth, data, data_size);
diff --git a/host/commands/secure_env/tpm_hmac.h b/host/commands/secure_env/tpm_hmac.h
index f5abf6b..4d179d3 100644
--- a/host/commands/secure_env/tpm_hmac.h
+++ b/host/commands/secure_env/tpm_hmac.h
@@ -47,5 +47,5 @@
     TpmResourceManager* resource_manager,
     ESYS_TR key_handle,
     TpmAuth auth,
-    uint8_t* data,
+    const uint8_t* data,
     size_t data_size);