diff --git a/libc/include/bits/fortify/fcntl.h b/libc/include/bits/fortify/fcntl.h
index 1f6ebad..ce600ff 100644
--- a/libc/include/bits/fortify/fcntl.h
+++ b/libc/include/bits/fortify/fcntl.h
@@ -30,13 +30,13 @@
 #error "Never include this file directly; instead, include <fcntl.h>"
 #endif
 
-int __open_2(const char*, int) __INTRODUCED_IN(17);
-int __openat_2(int, const char*, int) __INTRODUCED_IN(17);
+int __open_2(const char* _Nonnull, int) __INTRODUCED_IN(17);
+int __openat_2(int, const char* _Nonnull, int) __INTRODUCED_IN(17);
 /*
  * These are the easiest way to call the real open even in clang FORTIFY.
  */
-int __open_real(const char*, int, ...) __RENAME(open);
-int __openat_real(int, const char*, int, ...) __RENAME(openat);
+int __open_real(const char* _Nonnull, int, ...) __RENAME(open);
+int __openat_real(int, const char* _Nonnull, int, ...) __RENAME(openat);
 
 #if defined(__BIONIC_FORTIFY)
 #define __open_too_many_args_error "too many arguments"
@@ -46,7 +46,7 @@
 #define __open_modes_useful(flags) (((flags) & O_CREAT) || ((flags) & O_TMPFILE) == O_TMPFILE)
 
 __BIONIC_ERROR_FUNCTION_VISIBILITY
-int open(const char* pathname, int flags, mode_t modes, ...) __overloadable
+int open(const char* _Nonnull pathname, int flags, mode_t modes, ...) __overloadable
         __errorattr(__open_too_many_args_error);
 
 /*
@@ -56,7 +56,7 @@
  * open(const char *, int, ...).
  */
 __BIONIC_FORTIFY_INLINE
-int open(const char* const __pass_object_size pathname, int flags)
+int open(const char* _Nonnull const __pass_object_size pathname, int flags)
         __overloadable
         __clang_error_if(__open_modes_useful(flags), "'open' " __open_too_few_args_error) {
 #if __BIONIC_FORTIFY_RUNTIME_CHECKS_ENABLED
@@ -67,7 +67,7 @@
 }
 
 __BIONIC_FORTIFY_INLINE
-int open(const char* const __pass_object_size pathname, int flags, mode_t modes)
+int open(const char* _Nonnull const __pass_object_size pathname, int flags, mode_t modes)
         __overloadable
         __clang_warning_if(!__open_modes_useful(flags) && modes,
                            "'open' " __open_useless_modes_warning) {
@@ -75,12 +75,12 @@
 }
 
 __BIONIC_ERROR_FUNCTION_VISIBILITY
-int openat(int dirfd, const char* pathname, int flags, mode_t modes, ...)
+int openat(int dirfd, const char* _Nonnull pathname, int flags, mode_t modes, ...)
         __overloadable
         __errorattr(__open_too_many_args_error);
 
 __BIONIC_FORTIFY_INLINE
-int openat(int dirfd, const char* const __pass_object_size pathname, int flags)
+int openat(int dirfd, const char* _Nonnull const __pass_object_size pathname, int flags)
         __overloadable
         __clang_error_if(__open_modes_useful(flags), "'openat' " __open_too_few_args_error) {
 #if __BIONIC_FORTIFY_RUNTIME_CHECKS_ENABLED
@@ -91,7 +91,7 @@
 }
 
 __BIONIC_FORTIFY_INLINE
-int openat(int dirfd, const char* const __pass_object_size pathname, int flags, mode_t modes)
+int openat(int dirfd, const char* _Nonnull const __pass_object_size pathname, int flags, mode_t modes)
         __overloadable
         __clang_warning_if(!__open_modes_useful(flags) && modes,
                            "'openat' " __open_useless_modes_warning) {
@@ -101,18 +101,18 @@
 /* Note that open == open64, so we reuse those bits in the open64 variants below.  */
 
 __BIONIC_ERROR_FUNCTION_VISIBILITY
-int open64(const char* pathname, int flags, mode_t modes, ...) __overloadable
+int open64(const char* _Nonnull pathname, int flags, mode_t modes, ...) __overloadable
         __errorattr(__open_too_many_args_error);
 
 __BIONIC_FORTIFY_INLINE
-int open64(const char* const __pass_object_size pathname, int flags)
+int open64(const char* _Nonnull const __pass_object_size pathname, int flags)
         __overloadable
         __clang_error_if(__open_modes_useful(flags), "'open64' " __open_too_few_args_error) {
     return open(pathname, flags);
 }
 
 __BIONIC_FORTIFY_INLINE
-int open64(const char* const __pass_object_size pathname, int flags, mode_t modes)
+int open64(const char* _Nonnull const __pass_object_size pathname, int flags, mode_t modes)
         __overloadable
         __clang_warning_if(!__open_modes_useful(flags) && modes,
                            "'open64' " __open_useless_modes_warning) {
@@ -120,19 +120,19 @@
 }
 
 __BIONIC_ERROR_FUNCTION_VISIBILITY
-int openat64(int dirfd, const char* pathname, int flags, mode_t modes, ...)
+int openat64(int dirfd, const char* _Nonnull pathname, int flags, mode_t modes, ...)
         __overloadable
         __errorattr(__open_too_many_args_error);
 
 __BIONIC_FORTIFY_INLINE
-int openat64(int dirfd, const char* const __pass_object_size pathname, int flags)
+int openat64(int dirfd, const char* _Nonnull const __pass_object_size pathname, int flags)
         __overloadable
         __clang_error_if(__open_modes_useful(flags), "'openat64' " __open_too_few_args_error) {
     return openat(dirfd, pathname, flags);
 }
 
 __BIONIC_FORTIFY_INLINE
-int openat64(int dirfd, const char* const __pass_object_size pathname, int flags, mode_t modes)
+int openat64(int dirfd, const char* _Nonnull const __pass_object_size pathname, int flags, mode_t modes)
         __overloadable
         __clang_warning_if(!__open_modes_useful(flags) && modes,
                            "'openat64' " __open_useless_modes_warning) {
diff --git a/libc/include/bits/fortify/stdlib.h b/libc/include/bits/fortify/stdlib.h
index 623be58..b84dae4 100644
--- a/libc/include/bits/fortify/stdlib.h
+++ b/libc/include/bits/fortify/stdlib.h
@@ -35,7 +35,7 @@
 /* PATH_MAX is unavailable without polluting the namespace, but it's always 4096 on Linux */
 #define __PATH_MAX 4096
 
-char* realpath(const char* path, char* resolved)
+char* _Nullable realpath(const char* _Nonnull path, char* _Nullable resolved)
         __clang_error_if(!path, "'realpath': NULL path is never correct; flipped arguments?")
         __clang_error_if(__bos_unevaluated_lt(__bos(resolved), __PATH_MAX),
                          "'realpath' output parameter must be NULL or a pointer to a buffer "