diff --git a/src/core/lib/security/transport/security_handshaker.c b/src/core/lib/security/transport/security_handshaker.c
index 239a211c0b5a731bb8218180ce027b992357b15f..b9da6e16b2523d010df3ad5f9c16bd0e8ff88335 100644
--- a/src/core/lib/security/transport/security_handshaker.c
+++ b/src/core/lib/security/transport/security_handshaker.c
@@ -147,7 +147,7 @@ static void on_peer_checked(grpc_exec_ctx *exec_ctx, void *arg,
     goto done;
   }
   // Get unused bytes.
-  unsigned char *unused_bytes = NULL;
+  const unsigned char *unused_bytes = NULL;
   size_t unused_bytes_size = 0;
   result = tsi_handshaker_result_get_unused_bytes(
       h->handshaker_result, &unused_bytes, &unused_bytes_size);
diff --git a/src/core/tsi/fake_transport_security.c b/src/core/tsi/fake_transport_security.c
index 1280680663f981e5e8e3e6ef8de6aeb1716186df..810447313c5c30643d16f5af22808c61720d45a3 100644
--- a/src/core/tsi/fake_transport_security.c
+++ b/src/core/tsi/fake_transport_security.c
@@ -391,7 +391,7 @@ static tsi_result fake_handshaker_result_create_frame_protector(
 }
 
 static tsi_result fake_handshaker_result_get_unused_bytes(
-    const tsi_handshaker_result *self, unsigned char **bytes,
+    const tsi_handshaker_result *self, const unsigned char **bytes,
     size_t *bytes_size) {
   fake_handshaker_result *result = (fake_handshaker_result *)self;
   *bytes_size = result->unused_bytes_size;
diff --git a/src/core/tsi/transport_security.c b/src/core/tsi/transport_security.c
index be11d644721f4f2a784b307838379247f672f989..2b1f4310c14d79fd704d807e979bfcba98aaa23d 100644
--- a/src/core/tsi/transport_security.c
+++ b/src/core/tsi/transport_security.c
@@ -240,7 +240,7 @@ tsi_result tsi_handshaker_result_create_frame_protector(
 }
 
 tsi_result tsi_handshaker_result_get_unused_bytes(
-    const tsi_handshaker_result *self, unsigned char **bytes,
+    const tsi_handshaker_result *self, const unsigned char **bytes,
     size_t *bytes_size) {
   if (self == NULL || bytes == NULL || bytes_size == NULL) {
     return TSI_INVALID_ARGUMENT;
diff --git a/src/core/tsi/transport_security.h b/src/core/tsi/transport_security.h
index 4a56c25602a6e0697d88d86866e6fdc91ce6a73d..2c7db6bca920270be15860dd0a85f745985fe697 100644
--- a/src/core/tsi/transport_security.h
+++ b/src/core/tsi/transport_security.h
@@ -90,7 +90,8 @@ typedef struct {
                                        size_t *max_output_protected_frame_size,
                                        tsi_frame_protector **protector);
   tsi_result (*get_unused_bytes)(const tsi_handshaker_result *self,
-                                 unsigned char **bytes, size_t *bytes_size);
+                                 const unsigned char **bytes,
+                                 size_t *bytes_size);
   void (*destroy)(tsi_handshaker_result *self);
 } tsi_handshaker_result_vtable;
 
diff --git a/src/core/tsi/transport_security_adapter.c b/src/core/tsi/transport_security_adapter.c
index a0564945e47670b2b996ca57f4348ca4ec24a7ca..b6dc660c4756928017fea5a3e77d8b34f56eeb72 100644
--- a/src/core/tsi/transport_security_adapter.c
+++ b/src/core/tsi/transport_security_adapter.c
@@ -50,7 +50,7 @@ static tsi_result adapter_result_create_frame_protector(
 }
 
 static tsi_result adapter_result_get_unused_bytes(
-    const tsi_handshaker_result *self, unsigned char **bytes,
+    const tsi_handshaker_result *self, const unsigned char **bytes,
     size_t *byte_size) {
   tsi_adapter_handshaker_result *impl = (tsi_adapter_handshaker_result *)self;
   *bytes = impl->unused_bytes;
diff --git a/src/core/tsi/transport_security_interface.h b/src/core/tsi/transport_security_interface.h
index 137f8ee5c339a3d4688cdec8c7d8fc4e576fe20f..39ba8addc4985104bea4aee12252ce47e9f27d33 100644
--- a/src/core/tsi/transport_security_interface.h
+++ b/src/core/tsi/transport_security_interface.h
@@ -221,7 +221,7 @@ tsi_result tsi_handshaker_result_create_frame_protector(
    Ownership of the bytes is retained by the handshaker result. As a
    consequence, the caller must not free the bytes.  */
 tsi_result tsi_handshaker_result_get_unused_bytes(
-    const tsi_handshaker_result *self, unsigned char **bytes,
+    const tsi_handshaker_result *self, const unsigned char **bytes,
     size_t *byte_size);
 
 /* This method releases the tsi_handshaker_handshaker object. After this method