diff --git a/imap/calalarmd.c b/imap/calalarmd.c
index 72ac749f89..7a623da61c 100644
--- a/imap/calalarmd.c
+++ b/imap/calalarmd.c
@@ -66,7 +66,7 @@ extern char *optarg;
 
 static int debugmode = 0;
 
-struct namespace calalarmd_namespace;
+static struct namespace calalarmd_namespace;
 
 EXPORTED void fatal(const char *msg, int err)
 {
diff --git a/imap/ctl_conversationsdb.c b/imap/ctl_conversationsdb.c
index 2bb881739a..24453d065b 100644
--- a/imap/ctl_conversationsdb.c
+++ b/imap/ctl_conversationsdb.c
@@ -75,11 +75,11 @@ enum { UNKNOWN, DUMP, UNDUMP, ZERO, BUILD, RECALC, AUDIT, CHECKFOLDERS };
 
 static int verbose = 0;
 
-int mode = UNKNOWN;
+static int mode = UNKNOWN;
 static const char *audit_temp_directory;
 
-int recalc_silent = 1;
-hashu64_table *zerocids = NULL;
+static int recalc_silent = 1;
+static hashu64_table *zerocids = NULL;
 
 static int do_dump(const char *fname, const char *userid)
 {
diff --git a/imap/cyr_dbtool.c b/imap/cyr_dbtool.c
index 355ed2f902..5305bab92d 100644
--- a/imap/cyr_dbtool.c
+++ b/imap/cyr_dbtool.c
@@ -72,7 +72,7 @@
 #define STACKSIZE 64000
 static char stack[STACKSIZE+1];
 
-int outfd;
+static int outfd;
 
 static struct db *db = NULL;
 
diff --git a/imap/cyr_virusscan.c b/imap/cyr_virusscan.c
index b0157cd406..d5a64128ab 100644
--- a/imap/cyr_virusscan.c
+++ b/imap/cyr_virusscan.c
@@ -102,10 +102,12 @@ struct scan_rock {
 };
 
 /* globals for callback functions */
-int disinfect = 0;
-int email_notification = 0;
-struct infected_mbox *public = NULL;
-struct infected_mbox *user = NULL;
+static int disinfect = 0;
+static int email_notification = 0;
+#if 0
+static struct infected_mbox *public = NULL;
+#endif
+static struct infected_mbox *user = NULL;
 
 static int verbose = 0;
 
@@ -234,7 +236,7 @@ void clamav_destroy(void *state)
     free(st);
 }
 
-struct scan_engine engine =
+static struct scan_engine engine =
 { "ClamAV", NULL, &clamav_init, &clamav_scanfile, &clamav_destroy };
 
 #elif defined(HAVE_SOME_UNKNOWN_VIRUS_SCANNER)
@@ -242,7 +244,7 @@ struct scan_engine engine =
 
 #else
 /* NO configured virus scanner */
-struct scan_engine engine = { "<None Configured>", NULL, NULL, NULL, NULL };
+static struct scan_engine engine = { "<None Configured>", NULL, NULL, NULL, NULL };
 #endif
 
 
diff --git a/imap/dav_db.c b/imap/dav_db.c
index a569c4e224..cdc70413f3 100644
--- a/imap/dav_db.c
+++ b/imap/dav_db.c
@@ -291,7 +291,7 @@
 
 static int sievedb_upgrade(sqldb_t *db);
 
-struct sqldb_upgrade davdb_upgrade[] = {
+static const struct sqldb_upgrade davdb_upgrade[] = {
   { 2, CMD_DBUPGRADEv2, NULL },
   { 3, CMD_DBUPGRADEv3, NULL },
   { 4, CMD_DBUPGRADEv4, NULL },
diff --git a/imap/http_admin.c b/imap/http_admin.c
index 539b29c748..91ec47a10b 100644
--- a/imap/http_admin.c
+++ b/imap/http_admin.c
@@ -135,7 +135,7 @@ static void admin_init(struct buf *serverinfo __attribute__((unused)))
     compile_time = calc_compile_time(__TIME__, __DATE__);
 }
 
-const struct action_t {
+static const struct action_t {
     const char *name;
     const char *desc;
     int (*func)(struct transaction_t *txn);
diff --git a/imap/imapd.c b/imap/imapd.c
index 5bbb8e8a65..ce51995977 100644
--- a/imap/imapd.c
+++ b/imap/imapd.c
@@ -160,7 +160,7 @@ static int referral_kick = 0; /* kick after next command received, for
 
 /* global conversations database holder to avoid re-opening during
  * status command or list responses */
-struct conversations_state *global_conversations = NULL;
+static struct conversations_state *global_conversations = NULL;
 
 /* all subscription commands go to the backend server containing the
    user's inbox */
diff --git a/imap/lmtpd.c b/imap/lmtpd.c
index 1ab3212cc6..a3df1512f6 100644
--- a/imap/lmtpd.c
+++ b/imap/lmtpd.c
@@ -162,7 +162,7 @@ static struct protstream *deliver_out, *deliver_in;
 int deliver_logfd = -1; /* used in lmtpengine.c */
 
 /* our cached connections */
-ptrarray_t backend_cached = PTRARRAY_INITIALIZER;
+static ptrarray_t backend_cached = PTRARRAY_INITIALIZER;
 
 static struct protocol_t lmtp_protocol =
 { "lmtp", "lmtp", TYPE_STD,
diff --git a/imap/message_test.c b/imap/message_test.c
index 38847e2584..8ef90ec1b5 100644
--- a/imap/message_test.c
+++ b/imap/message_test.c
@@ -70,7 +70,7 @@
 static int usage(const char *name);
 
 static int verbose = 0;
-enum { PART_TREE, TEXT_SECTIONS, TEXT_RECEIVER } dump_mode = PART_TREE;
+static enum { PART_TREE, TEXT_SECTIONS, TEXT_RECEIVER } dump_mode = PART_TREE;
 
 /*-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-*/
 
diff --git a/imap/nntpd.c b/imap/nntpd.c
index 67fb58a01e..9f3c19adc8 100644
--- a/imap/nntpd.c
+++ b/imap/nntpd.c
@@ -123,10 +123,10 @@ extern int opterr;
    currently piping */
 
 /* the current server most commands go to */
-struct backend *backend_current = NULL;
+static struct backend *backend_current = NULL;
 
 /* our cached connections */
-ptrarray_t backend_cached = PTRARRAY_INITIALIZER;
+static ptrarray_t backend_cached = PTRARRAY_INITIALIZER;
 
 #ifdef HAVE_SSL
 static SSL *tls_conn;
diff --git a/imap/pop3d.c b/imap/pop3d.c
index bb6a8b8f91..39e00add82 100644
--- a/imap/pop3d.c
+++ b/imap/pop3d.c
@@ -160,7 +160,7 @@ const int config_need_data = CONFIG_NEED_PARTITION_DATA;
 static struct namespace popd_namespace;
 
 /* PROXY stuff */
-struct backend *backend = NULL;
+static struct backend *backend = NULL;
 
 static struct protocol_t pop3_protocol =
 { "pop3", "pop", TYPE_STD,
diff --git a/imap/quota_db.c b/imap/quota_db.c
index 5198a4279e..9f6dccc608 100644
--- a/imap/quota_db.c
+++ b/imap/quota_db.c
@@ -68,7 +68,7 @@
 
 #define QDB config_quota_db
 
-HIDDEN struct db *qdb;
+static struct db *qdb;
 
 /* skanky reuse of mboxname locks.  Ideally we would rename
  * them to something more general and use them elsewhere */
diff --git a/imap/smmapd.c b/imap/smmapd.c
index a983bce686..5b6f6db0ff 100644
--- a/imap/smmapd.c
+++ b/imap/smmapd.c
@@ -101,7 +101,7 @@
 /* generated headers are not necessarily in current directory */
 #include "imap/imap_err.h"
 
-const char *BB;
+static const char *BB;
 static int forcedowncase;
 
 extern int optind, opterr;
diff --git a/imap/sync_support.c b/imap/sync_support.c
index 66785e3985..75bd47ee1f 100644
--- a/imap/sync_support.c
+++ b/imap/sync_support.c
@@ -101,7 +101,7 @@
 
 static int opt_force = 0; // FIXME
 
-struct sync_client_state rightnow_sync_cs;
+static struct sync_client_state rightnow_sync_cs;
 
 /* protocol definitions */
 static char *imap_sasl_parsesuccess(char *str, const char **status);
diff --git a/imap/zoneinfo_db.c b/imap/zoneinfo_db.c
index 3c088a8d1a..a9b363339e 100644
--- a/imap/zoneinfo_db.c
+++ b/imap/zoneinfo_db.c
@@ -65,7 +65,7 @@
 
 #define DB config_zoneinfo_db
 
-struct db *zoneinfodb;
+static struct db *zoneinfodb;
 static int zoneinfo_dbopen = 0;
 static struct buf databuf = BUF_INITIALIZER;
 
diff --git a/lib/charset.c b/lib/charset.c
index ac0bf50879..46fe299cf6 100644
--- a/lib/charset.c
+++ b/lib/charset.c
@@ -85,7 +85,7 @@ EXPORTED void charset_lib_done(void)
 #define unicode_isvalid(c) \
         (!((c >= 0xd800 && c <= 0xdfff) || ((unsigned)c > 0x10ffff)))
 
-char QPSAFECHAR[256] = {
+static const char QPSAFECHAR[256] = {
 /* control chars are unsafe */
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
@@ -2555,7 +2555,7 @@ static charset_t lookup_buf(const char *buf, size_t len)
 /* of course = and _ are not included in the set, because they themselves
    need to be quoted it’s just saying they can be present in the Q wordi
    itself, because they’re part of the quoting system */
-char QPMIMEPHRASESAFECHAR[256] = {
+static const char QPMIMEPHRASESAFECHAR[256] = {
 /* control chars are unsafe */
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
diff --git a/ptclient/ptexpire.c b/ptclient/ptexpire.c
index c0ea0c7fc0..924a687d75 100644
--- a/ptclient/ptexpire.c
+++ b/ptclient/ptexpire.c
@@ -71,8 +71,8 @@
 #include "xmalloc.h"
 
 /* global */
-time_t timenow;
-time_t expire_time = (3*60*60); /* 3 Hours */
+static time_t timenow;
+static time_t expire_time = (3*60*60); /* 3 Hours */
 
 static int expire_p(void *rockp __attribute__((unused)),
                     const char *key __attribute__((unused)),
diff --git a/ptclient/ptloader.c b/ptclient/ptloader.c
index a8c15a8020..2eb7691fdb 100644
--- a/ptclient/ptloader.c
+++ b/ptclient/ptloader.c
@@ -227,7 +227,7 @@ char *ptsmodule_unix_canonifyid(const char *identifier, size_t len)
 const int config_need_data = 0;
 
 static char ptclient_debug = 0;
-struct db *ptsdb = NULL;
+static struct db *ptsdb = NULL;
 
 int service_init(int argc, char *argv[], char **envp __attribute__((unused)))
 {
diff --git a/timsieved/parser.c b/timsieved/parser.c
index f628392141..0015f12527 100644
--- a/timsieved/parser.c
+++ b/timsieved/parser.c
@@ -82,10 +82,10 @@ extern int sieved_userisadmin;
 extern sasl_conn_t *sieved_saslconn; /* the sasl connection context */
 static const char *referral_host = NULL;
 
-int authenticated = 0;
-int verify_only = 0;
-int starttls_done = 0;
-sasl_ssf_t sasl_ssf = 0;
+static int authenticated = 0;
+static int verify_only = 0;
+static int starttls_done = 0;
+static sasl_ssf_t sasl_ssf = 0;
 #ifdef HAVE_SSL
 /* our tls connection, if any */
 static SSL *tls_conn = NULL;
diff --git a/timsieved/timsieved.c b/timsieved/timsieved.c
index c3f6802abd..01a2b14d72 100644
--- a/timsieved/timsieved.c
+++ b/timsieved/timsieved.c
@@ -93,8 +93,8 @@ sasl_conn_t *sieved_saslconn; /* the sasl connection context */
 static struct auth_state *sieved_authstate = 0;
 
 int sieved_timeout;
-struct protstream *sieved_out;
-struct protstream *sieved_in;
+static struct protstream *sieved_out;
+static struct protstream *sieved_in;
 
 int sieved_logfd = -1;