diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index d9e2da0b..484655ed 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -35,7 +35,7 @@ jobs:
     - name: configure
       run: ./autogen.sh
       env:
-        CFLAGS: -fsanitize=undefined -fsanitize-undefined-trap-on-error -fsanitize=address -O2 -Wp,-D_FORTIFY_SOURCE=2
+        CFLAGS: -fsanitize=undefined -fsanitize-undefined-trap-on-error -fsanitize=address -O2 -Wp,-D_FORTIFY_SOURCE=2 -Werror
     - name: Build flatpak
       run: make -j $(getconf _NPROCESSORS_ONLN)
     - name: Run tests
@@ -96,7 +96,7 @@ jobs:
         sudo apt-get install -y $(xargs < .github/dependencies.apt.txt)
 
     - name: Configure flatpak-builder
-      run: meson setup --wrap-mode nodownload ${CONFIG_OPTS} ${BUILDDIR} .
+      run: meson setup --wrap-mode nodownload ${CONFIG_OPTS} -Dwerror=true ${BUILDDIR} .
 
     - name: Build flatpak-builder with Meson
       run: meson compile -C ${BUILDDIR}
diff --git a/meson.build b/meson.build
index 8a0138ca..d7fde29e 100644
--- a/meson.build
+++ b/meson.build
@@ -37,6 +37,17 @@ foreach arg : project_c_args
   endif
 endforeach
 
+if cc.get_id() == 'clang'
+  clang_args = [
+    '-Wno-typedef-redefinition',
+  ]
+  foreach arg : clang_args
+    if cc.has_argument(arg)
+      add_project_arguments(arg, language: 'c')
+    endif
+  endforeach
+endif
+
 # The debugedit program is a hard dependency
 debugedit = find_program('debugedit', version: '>= 5.0')
 
diff --git a/src/builder-flatpak-utils.c b/src/builder-flatpak-utils.c
index 927bdade..2829e7eb 100644
--- a/src/builder-flatpak-utils.c
+++ b/src/builder-flatpak-utils.c
@@ -185,7 +185,7 @@ flatpak_path_match_prefix (const char *pattern,
           /* special case * at end */
           if (c == 0)
             {
-              char *tmp = strchr (string, '/');
+              const char *tmp = strchr (string, '/');
               if (tmp != NULL)
                 return tmp;
               return string + strlen (string);
@@ -1163,11 +1163,11 @@ flatpak_create_curl_session (const char *user_agent)
   if (curl_session == NULL)
     return NULL;
 
-  curl_easy_setopt (curl_session, CURLOPT_CONNECTTIMEOUT, 60);
-  curl_easy_setopt (curl_session, CURLOPT_FAILONERROR, 1);
-  curl_easy_setopt (curl_session, CURLOPT_FOLLOWLOCATION, 1);
-  curl_easy_setopt (curl_session, CURLOPT_MAXREDIRS, 50);
-  curl_easy_setopt (curl_session, CURLOPT_NOPROGRESS, 0);
+  curl_easy_setopt (curl_session, CURLOPT_CONNECTTIMEOUT, 60L);
+  curl_easy_setopt (curl_session, CURLOPT_FAILONERROR, 1L);
+  curl_easy_setopt (curl_session, CURLOPT_FOLLOWLOCATION, 1L);
+  curl_easy_setopt (curl_session, CURLOPT_MAXREDIRS, 50L);
+  curl_easy_setopt (curl_session, CURLOPT_NOPROGRESS, 0L);
   curl_easy_setopt (curl_session, CURLOPT_LOW_SPEED_TIME, 60L);
   curl_easy_setopt (curl_session, CURLOPT_LOW_SPEED_LIMIT, 10000L);
   curl_easy_setopt (curl_session, CURLOPT_USERAGENT, user_agent);
@@ -1633,7 +1633,7 @@ get_xdg_user_dir_from_string (const char  *filesystem,
                               const char **suffix,
                               const char **dir)
 {
-  char *slash;
+  const char *slash;
   const char *rest;
   g_autofree char *prefix = NULL;
   gsize len;
@@ -2087,7 +2087,7 @@ option_add_generic_policy_cb (const gchar *option_name,
                               GError     **error)
 {
   FlatpakContext *context = data;
-  char *t;
+  const char *t;
   g_autofree char *key = NULL;
   const char *policy_value;
 
@@ -2114,7 +2114,7 @@ option_remove_generic_policy_cb (const gchar *option_name,
                                  GError     **error)
 {
   FlatpakContext *context = data;
-  char *t;
+  const char *t;
   g_autofree char *key = NULL;
   const char *policy_value;
   g_autofree char *extended_value = NULL;
diff --git a/src/builder-utils.c b/src/builder-utils.c
index 05be6616..7a844f5c 100644
--- a/src/builder-utils.c
+++ b/src/builder-utils.c
@@ -1117,10 +1117,10 @@ typedef struct {
 } CURLWriteData;
 
 static gsize
-builder_curl_write_cb (gpointer *buffer,
+builder_curl_write_cb (char     *buffer,
                        gsize     size,
                        gsize     nmemb,
-                       gpointer *userdata)
+                       void     *userdata)
 {
   gsize bytes_written;
   CURLWriteData *write_data = (CURLWriteData *) userdata;