diff --git a/jni.c b/jni.c
index 0a9f8154..90b8836c 100644
--- a/jni.c
+++ b/jni.c
@@ -484,7 +484,8 @@ static int process_auth_form_cb(void *privdata, struct oc_auth_form *form)
 	return -1;
 }
 
-static void progress_cb(void *privdata, int level, const char *fmt, ...)
+static void __attribute__ ((format(printf, 3, 4)))
+    progress_cb(void *privdata, int level, const char *fmt, ...)
 {
 	struct libctx *ctx = privdata;
 	va_list ap;
diff --git a/main.c b/main.c
index 13c46ff7..b197ccba 100644
--- a/main.c
+++ b/main.c
@@ -64,8 +64,8 @@ static const char *legacy_charset;
 
 static int write_new_config(void *_vpninfo,
 			    const char *buf, int buflen);
-static void write_progress(void *_vpninfo,
-			   int level, const char *fmt, ...);
+static void __attribute__ ((format(printf, 3, 4)))
+    write_progress(void *_vpninfo, int level, const char *fmt, ...);
 static int validate_peer_cert(void *_vpninfo,
 			      OPENCONNECT_X509 *peer_cert,
 			      const char *reason);
@@ -100,7 +100,8 @@ static int sig_cmd_fd;
 
 #ifdef __ANDROID__
 #include <android/log.h>
-static void syslog_progress(void *_vpninfo, int level, const char *fmt, ...)
+static void __attribute__ ((format(printf, 3, 4)))
+    syslog_progress(void *_vpninfo, int level, const char *fmt, ...)
 {
 	static int l[4] = {
 		ANDROID_LOG_ERROR,	/* PRG_ERR   */
@@ -129,7 +130,8 @@ static void syslog_progress(void *_vpninfo, int level, const char *fmt, ...)
  */
 #else /* !__ANDROID__ && !_WIN32 */
 #include <syslog.h>
-static void syslog_progress(void *_vpninfo, int level, const char *fmt, ...)
+static void  __attribute__ ((format(printf, 3, 4)))
+    syslog_progress(void *_vpninfo, int level, const char *fmt, ...)
 {
 	int priority = level ? LOG_INFO : LOG_NOTICE;
 	va_list args;
@@ -1496,7 +1498,8 @@ static int write_new_config(void *_vpninfo, const char *buf, int buflen)
 	return 0;
 }
 
-void write_progress(void *_vpninfo, int level, const char *fmt, ...)
+static void __attribute__ ((format(printf, 3, 4)))
+    write_progress(void *_vpninfo, int level, const char *fmt, ...)
 {
 	FILE *outf = level ? stdout : stderr;
 	va_list args;
diff --git a/openconnect-internal.h b/openconnect-internal.h
index 91db620c..065263d5 100644
--- a/openconnect-internal.h
+++ b/openconnect-internal.h
@@ -594,7 +594,8 @@ void cstp_free_splits(struct openconnect_info *vpninfo);
 /* ssl.c */
 unsigned string_is_hostname(const char* str);
 int connect_https_socket(struct openconnect_info *vpninfo);
-int request_passphrase(struct openconnect_info *vpninfo, const char *label,
+int __attribute__ ((format(printf, 4, 5)))
+    request_passphrase(struct openconnect_info *vpninfo, const char *label,
 		       char **response, const char *fmt, ...);
 int  __attribute__ ((format (printf, 2, 3)))
     openconnect_SSL_printf(struct openconnect_info *vpninfo, const char *fmt, ...);
diff --git a/ssl.c b/ssl.c
index dab88cb9..b50652d8 100644
--- a/ssl.c
+++ b/ssl.c
@@ -335,7 +335,8 @@ int  __attribute__ ((format (printf, 2, 3)))
 
 }
 
-int request_passphrase(struct openconnect_info *vpninfo, const char *label,
+int __attribute__ ((format(printf, 4, 5)))
+    request_passphrase(struct openconnect_info *vpninfo, const char *label,
 		       char **response, const char *fmt, ...)
 {
 	struct oc_auth_form f;