diff --git a/pvmfw/src/config.rs b/pvmfw/src/config.rs
index 39b7421..7b548ce 100644
--- a/pvmfw/src/config.rs
+++ b/pvmfw/src/config.rs
@@ -141,7 +141,7 @@
     pub bcc: &'a mut [u8],
     pub debug_policy: Option<&'a [u8]>,
     pub vm_dtbo: Option<&'a mut [u8]>,
-    pub vm_base_dtbo: Option<&'a mut [u8]>,
+    pub vm_base_dtbo: Option<&'a [u8]>,
 }
 
 #[repr(packed)]
@@ -297,6 +297,8 @@
 
         // We have no reason to mutate so drop the `mut`.
         let debug_policy = debug_policy.map(|x| &*x);
+        let vm_base_dtbo = vm_base_dtbo.map(|x| &*x);
+
         Entries { bcc, debug_policy, vm_dtbo, vm_base_dtbo }
     }
 }
diff --git a/pvmfw/src/entry.rs b/pvmfw/src/entry.rs
index c740d1b..8eca7a1 100644
--- a/pvmfw/src/entry.rs
+++ b/pvmfw/src/entry.rs
@@ -88,7 +88,7 @@
         kernel: usize,
         kernel_size: usize,
         vm_dtbo: Option<&mut [u8]>,
-        vm_base_dtbo: Option<&mut [u8]>,
+        vm_base_dtbo: Option<&[u8]>,
     ) -> Result<Self, RebootReason> {
         let fdt_size = NonZeroUsize::new(crosvm::FDT_MAX_SIZE).unwrap();
         // TODO - Only map the FDT as read-only, until we modify it right before jump_to_payload()
diff --git a/pvmfw/src/fdt.rs b/pvmfw/src/fdt.rs
index 44e55dd..33a5055 100644
--- a/pvmfw/src/fdt.rs
+++ b/pvmfw/src/fdt.rs
@@ -651,7 +651,7 @@
 pub fn sanitize_device_tree(
     fdt: &mut [u8],
     vm_dtbo: Option<&mut [u8]>,
-    vm_base_dtbo: Option<&mut [u8]>,
+    vm_base_dtbo: Option<&[u8]>,
 ) -> Result<DeviceTreeInfo, RebootReason> {
     let fdt = Fdt::from_mut_slice(fdt).map_err(|e| {
         error!("Failed to load FDT: {e}");
@@ -696,7 +696,7 @@
     }
 
     if let Some(vm_base_dtbo) = vm_base_dtbo {
-        let vm_base_dtbo = Fdt::from_mut_slice(vm_base_dtbo).map_err(|e| {
+        let vm_base_dtbo = Fdt::from_slice(vm_base_dtbo).map_err(|e| {
             error!("Failed to load VM base DTBO: {e}");
             RebootReason::InvalidFdt
         })?;