diff --git a/crypto/x509/x509_set.c b/crypto/x509/x509_set.c
index 6fd0d63..470bf70 100644
--- a/crypto/x509/x509_set.c
+++ b/crypto/x509/x509_set.c
@@ -221,7 +221,7 @@
     return (X509_PUBKEY_set(&(x->cert_info->key), pkey));
 }
 
-STACK_OF(X509_EXTENSION) *X509_get0_extensions(const X509 *x)
+const STACK_OF(X509_EXTENSION) *X509_get0_extensions(const X509 *x)
 {
     return x->cert_info->extensions;
 }
diff --git a/include/openssl/x509.h b/include/openssl/x509.h
index 9d307d4..38a4219 100644
--- a/include/openssl/x509.h
+++ b/include/openssl/x509.h
@@ -968,9 +968,8 @@
 OPENSSL_EXPORT int X509_set_pubkey(X509 *x, EVP_PKEY *pkey);
 OPENSSL_EXPORT EVP_PKEY *X509_get_pubkey(X509 *x);
 OPENSSL_EXPORT ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x);
-// TODO(davidben): |X509_get0_extensions| should return a const pointer to
-// match upstream.
-OPENSSL_EXPORT STACK_OF(X509_EXTENSION) *X509_get0_extensions(const X509 *x);
+OPENSSL_EXPORT const STACK_OF(X509_EXTENSION) *
+    X509_get0_extensions(const X509 *x);
 OPENSSL_EXPORT const X509_ALGOR *X509_get0_tbs_sigalg(const X509 *x);
 
 OPENSSL_EXPORT int X509_REQ_set_version(X509_REQ *x, long version);