diff --git a/Makefile b/Makefile
index b9bab17..f41a35c 100644
--- a/Makefile
+++ b/Makefile
@@ -5,6 +5,8 @@ PREFIX = /usr/local
 BINDIR = $(PREFIX)/bin
 MANDIR = $(PREFIX)/share/man
 
+CFLAGS = -Wall -Werror -Wextra
+
 all: $(BIN)
 
 $(BIN): $(BIN).c base64.c jsmn.c
diff --git a/jsmn.c b/jsmn.c
index 591185f..9fda563 100644
--- a/jsmn.c
+++ b/jsmn.c
@@ -31,7 +31,7 @@
 static jsmntok_t *jsmn_alloc_token(jsmn_parser *parser, 
 		jsmntok_t *tokens, size_t num_tokens) {
 	jsmntok_t *tok;
-	if (parser->toknext >= num_tokens) {
+	if (parser->toknext >= (int)num_tokens) {
 		return NULL;
 	}
 	tok = &tokens[parser->toknext++];
diff --git a/sbotc.c b/sbotc.c
index b907aba..89f80c6 100644
--- a/sbotc.c
+++ b/sbotc.c
@@ -328,7 +328,7 @@ static ssize_t json_get_value(const char *buf, const char *path, const char **va
 
 	while (*path) {
 		const char *end = strchr(path, '.');
-		size_t part_len = end ? end - path : strlen(path);
+		size_t part_len = end ? (size_t)end - (size_t)path : strlen(path);
 		tok = json_lookup(buf, tok, path, part_len);
 		if (!tok) { errno = ENOMSG; return -1; }
 		path += part_len;
@@ -354,7 +354,7 @@ static void get_app_dir(char *dir, size_t len) {
 	if (!appname) appname = "ssb";
 	rc = snprintf(dir, len, "%s/.%s", home, appname);
 	if (rc < 0) err(1, "failed to get app dir");
-	if (rc >= len) errx(1, "path to app dir too long");
+	if ((size_t)rc >= len) errx(1, "path to app dir too long");
 }
 
 static ssize_t read_file(char *buf, size_t len, const char *fmt, ...) {
@@ -367,11 +367,11 @@ static ssize_t read_file(char *buf, size_t len, const char *fmt, ...) {
 	rc = vsnprintf(buf, len, fmt, ap);
 	va_end(ap);
 	if (rc < 0) return -1;
-	if (rc >= len) { errno = ENAMETOOLONG; return -1; }
+	if ((size_t)rc >= len) { errno = ENAMETOOLONG; return -1; }
 
 	rc = stat(buf, &st);
 	if (rc < 0) return -1;
-	if (st.st_size > len-1) { errno = EMSGSIZE; return -1; }
+	if (st.st_size > (off_t)(len-1)) { errno = EMSGSIZE; return -1; }
 
 	fd = open(buf, O_RDONLY);
 	if (fd < 0) return -1;
@@ -552,7 +552,7 @@ static void muxrpc_call(struct boxs *bs, const char *method, const char *argumen
 				  method, argument, typestr);
 	}
 	if (reqlen < 0) err(1, "failed to construct request");
-	if (reqlen >= sizeof(req)) errx(1, "request too large");
+	if ((size_t)reqlen >= sizeof(req)) errx(1, "request too large");
 
 	ps_write(bs, req, reqlen, pkt_type_json, req_id, !is_request, false);
 }
@@ -560,6 +560,8 @@ static void muxrpc_call(struct boxs *bs, const char *method, const char *argumen
 static void ps_reject(struct boxs *bs, size_t len, int32_t req, enum pkt_flags flags) {
 	// ignore the packet. if this is a request, the substream on the other end
 	// will just have to wait until the rpc connection closes.
+	(void)req;
+	(void)flags;
 	write_buf(STDERR_FILENO, "ignoring packet: ");
 	int rc = bs_read_out(bs, STDERR_FILENO, len);
 	if (rc < 0) err(1, "bs_read_out");
@@ -646,7 +648,7 @@ static enum stream_state muxrpc_write_sink_1(struct boxs *bs, int infd,
 static enum stream_state muxrpc_write_sink_1_hashed(struct boxs *bs, int infd,
 		crypto_hash_sha256_state *hash_state, int req_id) {
 	int rc;
-	char buf[4096];
+	unsigned char buf[4096];
 	ssize_t sz = read(infd, buf, sizeof(buf));
 	if (sz < 0) err(1, "read");
 	if (sz == 0) {
@@ -655,7 +657,7 @@ static enum stream_state muxrpc_write_sink_1_hashed(struct boxs *bs, int infd,
 	}
 	rc = crypto_hash_sha256_update(hash_state, buf, sz);
 	if (rc < 0) errx(1, "hash update failed");
-	ps_write(bs, buf, sz, pkt_type_buffer, req_id, true, false);
+	ps_write(bs, (char *)buf, sz, pkt_type_buffer, req_id, true, false);
 	return stream_state_open;
 }
 
@@ -812,7 +814,6 @@ int main(int argc, char *argv[]) {
 	enum pkt_type ptype = pkt_type_buffer;
 	char method[256];
 	char app_dir[_POSIX_PATH_MAX];
-	char argument[argument_len];
 	ssize_t len;
 	bool test = false;
 
@@ -852,8 +853,10 @@ int main(int argc, char *argv[]) {
 		memcpy(shs_cap_key, ssb_cap, 32);
 	}
 
+	argument_len = test ? 0 : args_to_json_length(argc-i, argv+i);
+	char argument[argument_len];
+
 	if (!test) {
-		argument_len = args_to_json_length(argc-i, argv+i);
 		rc = args_to_json(argument, sizeof(argument), argc-i, argv+i);
 		if (rc < 0) errx(0, "unable to collect arguments");