diff --git a/ChangeLog b/ChangeLog
index 7396fe09d..eea43e7c0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -95,6 +95,9 @@
    - deraadt@cvs.openbsd.org 2006/03/20 18:41:43
      [dns.c]
      cast xstrdup to propert u_char *
+   - deraadt@cvs.openbsd.org 2006/03/20 18:42:27
+     [canohost.c match.c ssh.c sshconnect.c]
+     be strict with tolower() casting
 
 20060325
  - OpenBSD CVS Sync
@@ -4352,4 +4355,4 @@
    - (djm) Trim deprecated options from INSTALL. Mention UsePAM
    - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu
 
-$Id: ChangeLog,v 1.4269 2006/03/26 03:09:09 djm Exp $
+$Id: ChangeLog,v 1.4270 2006/03/26 03:09:54 djm Exp $
diff --git a/canohost.c b/canohost.c
index 4fafb0b82..b1c35e99e 100644
--- a/canohost.c
+++ b/canohost.c
@@ -88,7 +88,7 @@ get_remote_hostname(int sock, int use_dns)
 	 */
 	for (i = 0; name[i]; i++)
 		if (isupper(name[i]))
-			name[i] = tolower(name[i]);
+			name[i] = (char)tolower(name[i]);
 	/*
 	 * Map it back to an IP address and check that the given
 	 * address actually is an address of this host.  This is
diff --git a/match.c b/match.c
index 736047df1..e08afdeb0 100644
--- a/match.c
+++ b/match.c
@@ -137,7 +137,7 @@ match_pattern_list(const char *string, const char *pattern, u_int len,
 		    i < len && subi < sizeof(sub) - 1 && pattern[i] != ',';
 		    subi++, i++)
 			sub[subi] = dolower && isupper(pattern[i]) ?
-			    tolower(pattern[i]) : pattern[i];
+			    (char)tolower(pattern[i]) : pattern[i];
 		/* If subpattern too long, return failure (no match). */
 		if (subi >= sizeof(sub) - 1)
 			return 0;
diff --git a/ssh.c b/ssh.c
index 2681ccb6b..0c950745b 100644
--- a/ssh.c
+++ b/ssh.c
@@ -629,7 +629,7 @@ main(int ac, char **av)
 	if (options.host_key_alias != NULL) {
 		for (p = options.host_key_alias; *p; p++)
 			if (isupper(*p))
-				*p = tolower(*p);
+				*p = (char)tolower(*p);
 	}
 
 	/* Get default port if port has not been set. */
diff --git a/sshconnect.c b/sshconnect.c
index 53b5200ff..33961e4dc 100644
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -927,7 +927,7 @@ ssh_login(Sensitive *sensitive, const char *orighost,
 	host = xstrdup(orighost);
 	for (cp = host; *cp; cp++)
 		if (isupper(*cp))
-			*cp = tolower(*cp);
+			*cp = (char)tolower(*cp);
 
 	/* Exchange protocol version identification strings with the server. */
 	ssh_exchange_identification();