diff --git a/ext/openssl/ossl_config.c b/ext/openssl/ossl_config.c
index 203d7ef29..3b387239a 100644
--- a/ext/openssl/ossl_config.c
+++ b/ext/openssl/ossl_config.c
@@ -87,6 +87,7 @@ config_s_parse(VALUE klass, VALUE str)
 
     bio = ossl_obj2bio(&str);
     config_load_bio(conf, bio); /* Consumes BIO */
+    rb_obj_freeze(obj);
     return obj;
 }
 
@@ -144,6 +145,7 @@ config_initialize(int argc, VALUE *argv, VALUE self)
             ossl_raise(eConfigError, "BIO_new_file");
         config_load_bio(conf, bio); /* Consumes BIO */
     }
+    rb_obj_freeze(self);
     return self;
 }
 
@@ -158,6 +160,7 @@ config_initialize_copy(VALUE self, VALUE other)
     rb_check_frozen(self);
     bio = ossl_obj2bio(&str);
     config_load_bio(conf, bio); /* Consumes BIO */
+    rb_obj_freeze(self);
     return self;
 }
 
@@ -453,6 +456,6 @@ Init_ossl_config(void)
      * The default system configuration file for OpenSSL.
      */
     path = CONF_get1_default_config_file();
-    path_str = ossl_buf2str(path, rb_long2int(strlen(path)));
+    path_str = rb_obj_freeze(ossl_buf2str(path, rb_long2int(strlen(path))));
     rb_define_const(cConfig, "DEFAULT_CONFIG_FILE", path_str);
 }
diff --git a/test/openssl/test_config.rb b/test/openssl/test_config.rb
index 6dbb9c613..298e99f41 100644
--- a/test/openssl/test_config.rb
+++ b/test/openssl/test_config.rb
@@ -188,6 +188,8 @@ def test_initialize
     c = OpenSSL::Config.new
     assert_equal("", c.to_s)
     assert_equal([], c.sections)
+    assert c.frozen?
+    assert c.dup.frozen?
   end
 
   def test_initialize_with_empty_file