diff --git a/src/shrpx.cc b/src/shrpx.cc
index bd250316..98c0f12b 100644
--- a/src/shrpx.cc
+++ b/src/shrpx.cc
@@ -791,7 +791,8 @@ int create_tcp_server_socket(UpstreamAddr &faddr,
   }
 
   faddr.fd = fd;
-  faddr.hostport = util::make_http_hostport(StringRef{host.data()}, faddr.port);
+  faddr.hostport = ImmutableString{
+      util::make_http_hostport(StringRef{host.data()}, faddr.port)};
 
   LOG(NOTICE) << "Listening on " << faddr.hostport
               << (faddr.tls ? ", tls" : "");
diff --git a/src/shrpx_config.cc b/src/shrpx_config.cc
index 91797dfb..d84e7f0f 100644
--- a/src/shrpx_config.cc
+++ b/src/shrpx_config.cc
@@ -2049,7 +2049,7 @@ int parse_config(Config *config, int optid, const StringRef &opt,
       LOG(ERROR) << opt << ": Couldn't read key file's passwd from " << optarg;
       return -1;
     }
-    config->tls.private_key_passwd = passwd;
+    config->tls.private_key_passwd = ImmutableString{passwd};
 
     return 0;
   }
@@ -2958,7 +2958,7 @@ int configure_downstream_group(Config *config, bool http2_proxy,
     auto &sni = tlsconf.backend_sni_name;
     for (auto &addr_group : addr_groups) {
       for (auto &addr : addr_group.addrs) {
-        addr.sni = sni;
+        addr.sni = ImmutableString{sni};
       }
     }
   }
diff --git a/src/template.h b/src/template.h
index 496ac178..31ab13ff 100644
--- a/src/template.h
+++ b/src/template.h
@@ -257,7 +257,7 @@ public:
       : len(slen), base(copystr(s, s + len)) {}
   explicit ImmutableString(const char *s)
       : len(strlen(s)), base(copystr(s, s + len)) {}
-  ImmutableString(const std::string &s)
+  explicit ImmutableString(const std::string &s)
       : len(s.size()), base(copystr(std::begin(s), std::end(s))) {}
   template <typename InputIt>
   ImmutableString(InputIt first, InputIt last)