diff --git a/sys/can/conn/raw.c b/sys/can/conn/raw.c
index f836d52c5436..fb6f5a8233b2 100644
--- a/sys/can/conn/raw.c
+++ b/sys/can/conn/raw.c
@@ -39,7 +39,7 @@
 #define CONN_CAN_ISOTP_TIMEOUT_TX_CONF_US   (1 * US_PER_SEC)
 #endif
 
-int conn_can_raw_create(conn_can_raw_t *conn, struct can_filter *filter, size_t count,
+int conn_can_raw_create(conn_can_raw_t *conn, const struct can_filter *filter, size_t count,
                         int ifnum, int flags)
 {
     assert(conn != NULL);
@@ -71,7 +71,7 @@ int conn_can_raw_create(conn_can_raw_t *conn, struct can_filter *filter, size_t
     return conn_can_raw_set_filter(conn, filter, count);
 }
 
-int conn_can_raw_set_filter(conn_can_raw_t *conn, struct can_filter *filter, size_t count)
+int conn_can_raw_set_filter(conn_can_raw_t *conn, const struct can_filter *filter, size_t count)
 {
     assert(conn != NULL);
     assert(filter != NULL || count == 0);
diff --git a/sys/can/dll.c b/sys/can/dll.c
index 8c86184c5f66..cf63ec683ed6 100644
--- a/sys/can/dll.c
+++ b/sys/can/dll.c
@@ -166,9 +166,10 @@ int raw_can_abort(int ifnum, int handle)
     return 0;
 }
 
-static int register_filter_entry(can_reg_entry_t *entry, struct can_filter *filter, void *param)
+static int register_filter_entry(can_reg_entry_t *entry, const struct can_filter *filter, void *param)
 {
-    msg_t msg, reply;
+    msg_t msg;
+    msg_t reply;
     int ret;
 
     DEBUG("register_filter_entry: ifnum=%d, filter=0x%" PRIx32 ", mask=0x%" PRIx32 ", param=%p\n",
@@ -178,13 +179,13 @@ static int register_filter_entry(can_reg_entry_t *entry, struct can_filter *filt
     if (ret < 0) {
         return -ENOMEM;
     }
-    else if (ret == 1) {
+    if (ret == 1) {
         DEBUG("raw_can_subscribe_rx: filter=0x%" PRIx32 " already in use\n", filter->can_id);
         return 0;
     }
 
     msg.type = CAN_MSG_SET_FILTER;
-    msg.content.ptr = filter;
+    msg.content.ptr = (void *)filter;
     msg_send_receive(&msg, &reply, candev_list[entry->ifnum]->pid);
 
     if ((int) reply.content.value < 0) {
@@ -195,9 +196,10 @@ static int register_filter_entry(can_reg_entry_t *entry, struct can_filter *filt
     return 0;
 }
 
-static int unregister_filter_entry(can_reg_entry_t *entry, struct can_filter *filter, void *param)
+static int unregister_filter_entry(can_reg_entry_t *entry, const struct can_filter *filter, void *param)
 {
-    msg_t msg, reply;
+    msg_t msg;
+    msg_t reply;
     int ret;
 
     DEBUG("unregister_filter_entry: ifnum=%d, filter=0x%" PRIx32 ", mask=0x%" PRIx32 ", param=%p\n",
@@ -207,13 +209,13 @@ static int unregister_filter_entry(can_reg_entry_t *entry, struct can_filter *fi
     if (ret < 0) {
         return -ENOMEM;
     }
-    else if (ret == 1) {
+    if (ret == 1) {
         DEBUG("raw_can_unsubscribe_rx: filter=0x%" PRIx32 " still in use\n", filter->can_id);
         return 0;
     }
 
     msg.type = CAN_MSG_REMOVE_FILTER;
-    msg.content.ptr = filter;
+    msg.content.ptr = (void *)filter;
     msg_send_receive(&msg, &reply, candev_list[entry->ifnum]->pid);
 
     if ((int) reply.content.value < 0) {
@@ -223,7 +225,7 @@ static int unregister_filter_entry(can_reg_entry_t *entry, struct can_filter *fi
     return 0;
 }
 
-int raw_can_subscribe_rx(int ifnum, struct can_filter *filter, kernel_pid_t pid, void *param)
+int raw_can_subscribe_rx(int ifnum, const struct can_filter *filter, kernel_pid_t pid, void *param)
 {
     assert(ifnum < candev_nb);
     assert(filter);
@@ -239,7 +241,7 @@ int raw_can_subscribe_rx(int ifnum, struct can_filter *filter, kernel_pid_t pid,
 }
 
 #ifdef MODULE_CAN_MBOX
-int raw_can_subscribe_rx_mbox(int ifnum, struct can_filter *filter, mbox_t *mbox, void *param)
+int raw_can_subscribe_rx_mbox(int ifnum, const struct can_filter *filter, mbox_t *mbox, void *param)
 {
     assert(ifnum < candev_nb);
     assert(filter);
@@ -269,7 +271,7 @@ int raw_can_unsubscribe_rx(int ifnum, struct can_filter *filter, kernel_pid_t pi
 }
 
 #ifdef MODULE_CAN_MBOX
-int raw_can_unsubscribe_rx_mbox(int ifnum, struct can_filter *filter, mbox_t *mbox, void *param)
+int raw_can_unsubscribe_rx_mbox(int ifnum, const struct can_filter *filter, mbox_t *mbox, void *param)
 {
     assert(ifnum < candev_nb);
     assert(filter);
diff --git a/sys/include/can/conn/isotp.h b/sys/include/can/conn/isotp.h
index 14b8c8ada932..0bf9c4a50563 100644
--- a/sys/include/can/conn/isotp.h
+++ b/sys/include/can/conn/isotp.h
@@ -23,6 +23,7 @@
 extern "C" {
 #endif
 
+#include "compiler_hints.h"
 #include "can/can.h"
 #include "can/isotp.h"
 #include "mbox.h"
@@ -164,6 +165,7 @@ int conn_can_isotp_close(conn_can_isotp_t *conn);
  * @return the number of bytes received
  * @return any other negative number in case of an error
  */
+ACCESS(write_only, 2, 3)
 int conn_can_isotp_recv(conn_can_isotp_t *conn, void *buf, size_t size, uint32_t timeout);
 
 /**
@@ -178,6 +180,7 @@ int conn_can_isotp_recv(conn_can_isotp_t *conn, void *buf, size_t size, uint32_t
  * @return the number of bytes sent
  * @return any other negative number in case of an error
  */
+ACCESS(read_only, 2, 3)
 int conn_can_isotp_send(conn_can_isotp_t *conn, const void *buf, size_t size, int flags);
 
 #if defined(MODULE_CONN_CAN_ISOTP_MULTI) || defined(DOXYGEN)
diff --git a/sys/include/can/conn/raw.h b/sys/include/can/conn/raw.h
index 7a3af937d532..b16bf545da6a 100644
--- a/sys/include/can/conn/raw.h
+++ b/sys/include/can/conn/raw.h
@@ -28,6 +28,7 @@
 extern "C" {
 #endif
 
+#include "compiler_hints.h"
 #include "can/can.h"
 #include "can/raw.h"
 #include "mbox.h"
@@ -51,11 +52,11 @@ extern "C" {
  * @brief   RAW CAN connection
  */
 typedef struct conn_can_raw {
-    int ifnum;                 /**< Interface number of the can device */
-    int flags;                 /**< Config flags for that conn object */
-    size_t count;              /**< number of filters set */
-    struct can_filter *filter; /**< list of filter */
-    mbox_t mbox;               /**< mbox */
+    int ifnum;                          /**< Interface number of the can device */
+    int flags;                          /**< Config flags for that conn object */
+    size_t count;                       /**< number of filters set */
+    const struct can_filter *filter;    /**< list of filter */
+    mbox_t mbox;                        /**< mbox */
     /**
      * message queue
      */
@@ -76,7 +77,8 @@ typedef struct conn_can_raw {
  * @return 0 if socket was successfully connected
  * @return any other negative number in case of an error
  */
-int conn_can_raw_create(conn_can_raw_t *conn, struct can_filter *filter, size_t count,
+ACCESS(read_only, 2, 3)
+int conn_can_raw_create(conn_can_raw_t *conn, const struct can_filter *filter, size_t count,
                         int ifnum, int flags);
 
 /**
@@ -131,7 +133,8 @@ int conn_can_raw_send(conn_can_raw_t *conn, const can_frame_t *frame, int flags)
  * @return 0 if can filters were successfully set
  * @return any other negative number in case of an error
  */
-int conn_can_raw_set_filter(conn_can_raw_t *conn, struct can_filter *filter, size_t count);
+ACCESS(read_only, 2, 3)
+int conn_can_raw_set_filter(conn_can_raw_t *conn, const struct can_filter *filter, size_t count);
 
 #ifdef __cplusplus
 }
diff --git a/sys/include/can/isotp.h b/sys/include/can/isotp.h
index a824c58cc9c1..5f45daeb4a13 100644
--- a/sys/include/can/isotp.h
+++ b/sys/include/can/isotp.h
@@ -26,29 +26,30 @@ extern "C" {
 
 #include "can/can.h"
 #include "can/common.h"
+#include "compiler_hints.h"
+#include "net/gnrc/pktbuf.h"
 #include "thread.h"
 #include "ztimer.h"
-#include "net/gnrc/pktbuf.h"
 
 #ifndef CAN_ISOTP_BS
 /**
  * @brief   Default Block Size for RX Flow Control frames
  */
-#define CAN_ISOTP_BS        (10)
+#  define CAN_ISOTP_BS (10)
 #endif
 
 #ifndef CAN_ISOTP_STMIN
 /**
  * @brief   Default STmin for RX Flow Control frames
  */
-#define CAN_ISOTP_STMIN     (5)
+#  define CAN_ISOTP_STMIN (5)
 #endif
 
 #ifndef CAN_ISOTP_WFTMAX
 /**
  * @brief   Default maximum WFT for TX Flow Control
  */
-#define CAN_ISOTP_WFTMAX    (1)
+#  define CAN_ISOTP_WFTMAX (1)
 #endif
 
 /**
@@ -168,6 +169,7 @@ kernel_pid_t isotp_init(char *stack, int stacksize, char priority, const char *n
  * @return the number of bytes sent
  * @return < 0 if an error occurred  (-EBUSY, -ENOMEM)
  */
+ACCESS(read_only, 2, 3)
 int isotp_send(struct isotp *isotp, const void *buf, int len, int flags);
 
 /**
diff --git a/sys/include/can/raw.h b/sys/include/can/raw.h
index 66a3350d1bf8..aa5c39b4f6ad 100644
--- a/sys/include/can/raw.h
+++ b/sys/include/can/raw.h
@@ -91,7 +91,7 @@ int raw_can_abort(int ifnum, int handle);
  * @return the @p ifnum on success
  * @return < 0 on error
  */
-int raw_can_subscribe_rx(int ifnum, struct can_filter *filter, kernel_pid_t pid, void *param);
+int raw_can_subscribe_rx(int ifnum, const struct can_filter *filter, kernel_pid_t pid, void *param);
 
 /**
  * @brief Unsubscribe from reception for the given CAN @p filter on @p pid thread
@@ -174,7 +174,7 @@ int raw_can_send_mbox(int ifnum, const can_frame_t *frame, mbox_t *mbox);
  * @return the @p ifnum on success
  * @return < 0 on error
  */
-int raw_can_subscribe_rx_mbox(int ifnum, struct can_filter *filter, mbox_t *mbox, void *param);
+int raw_can_subscribe_rx_mbox(int ifnum, const struct can_filter *filter, mbox_t *mbox, void *param);
 
 /**
  * @brief Unsubscribe from reception for the given CAN @p filter and @p mbox
@@ -187,7 +187,7 @@ int raw_can_subscribe_rx_mbox(int ifnum, struct can_filter *filter, mbox_t *mbox
  * @return 0 on success
  * @return < 0 on error
  */
-int raw_can_unsubscribe_rx_mbox(int ifnum, struct can_filter *filter, mbox_t *mbox, void *param);
+int raw_can_unsubscribe_rx_mbox(int ifnum, const struct can_filter *filter, mbox_t *mbox, void *param);
 #endif
 
 /**