diff --git a/src/capi-bridge.h b/src/capi-bridge.h
index c0d0b54..6a4a7b8 100644
--- a/src/capi-bridge.h
+++ b/src/capi-bridge.h
@@ -16,8 +16,10 @@
 extern "C" {
 #endif
 
+#define _ro_p(n) __attribute__((access (read_only, n)))
+
 rng_t* RNG_IMPL(mkdriver)(enum rng_kind kind, const u64* restrict seed) _export(internal);
-int RNG_IMPL(mnext)(rng_t* engine, void* restrict output, const struct rng_next_opt* restrict opt) _export(internal);
+int RNG_IMPL(mnext)(rng_t* engine, void* restrict output, const struct rng_next_opt* restrict opt) _ro_p(3)  _export(internal);
 
 int RNG_IMPL(m_allocsz_for)(enum rng_next_type ty, size_t* restrict size, size_t* restrict align) _export(internal);
 
@@ -25,6 +27,8 @@ rng_t* RNG_IMPL(dynctor_trycall)(const char* name, const void* seed) _export(int
 struct rng_dyn_ctor* RNG_IMPL(dynctor_refer)(const char* name) _export(internal);
 rng_t* RNG_IMPL(dynctor_callref)(struct rng_dyn_ctor* ptr, const void* seed) _export(internal);
 
+#undef _ro_p
+
 #ifdef __cplusplus
 }
 #endif