diff --git a/lib/secure-streams/protocols/ss-h2.c b/lib/secure-streams/protocols/ss-h2.c
index 3d1aa9c23..910067ab7 100644
--- a/lib/secure-streams/protocols/ss-h2.c
+++ b/lib/secure-streams/protocols/ss-h2.c
@@ -52,7 +52,7 @@ secstream_h2(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 			 */
 			lwsl_info("%s: reporting initial tx cr from server %d\n",
 				  __func__, wsi->txc.tx_cr);
-			ss_proxy_onward_txcr((void *)&h[1], wsi->txc.tx_cr);
+			ss_proxy_onward_txcr((void *)(h + 1), wsi->txc.tx_cr);
 		}
 #endif
 
@@ -106,7 +106,7 @@ secstream_h2(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 #if defined(LWS_WITH_SECURE_STREAMS_PROXY_API)
 		if (h->being_serialized)
 			/* we are the proxy-side SS for a remote client */
-			ss_proxy_onward_txcr((void *)&h[1], (int)len);
+			ss_proxy_onward_txcr((void *)(h + 1), (int)len);
 #endif
 		break;
 
diff --git a/lib/secure-streams/secure-streams-client.c b/lib/secure-streams/secure-streams-client.c
index 76ea9522e..075cf9657 100644
--- a/lib/secure-streams/secure-streams-client.c
+++ b/lib/secure-streams/secure-streams-client.c
@@ -84,7 +84,7 @@ lws_sspc_event_helper(lws_sspc_handle_t *h, lws_ss_constate_t cs,
 		return LWSSSSRET_OK;
 
 	h->h_in_svc = h;
-	ret = h->ssi.state((void *)((uint8_t *)&h[1]), NULL, cs, flags);
+	ret = h->ssi.state((void *)((uint8_t *)(h + 1)), NULL, cs, flags);
 	h->h_in_svc = NULL;
 
 	return ret;
@@ -201,7 +201,7 @@ callback_sspc_client(struct lws *wsi, enum lws_callback_reasons reason,
 {
 	lws_sspc_handle_t *h = (lws_sspc_handle_t *)lws_get_opaque_user_data(wsi);
 	size_t pktsize = wsi->a.context->max_http_header_data;
-	void *m = (void *)((uint8_t *)&h[1]);
+	void *m = (void *)((uint8_t *)(h + 1));
 	uint8_t *pkt = NULL, *p = NULL, *end = NULL;
 	lws_ss_state_return_t r;
 	uint64_t interval;
@@ -661,7 +661,7 @@ lws_sspc_create(struct lws_context *context, int tsi, const lws_ss_info_t *ssi,
 			ssi->streamtype);
 
 	memcpy(&h->ssi, ssi, sizeof(*ssi));
-	ua = (uint8_t *)&h[1];
+	ua = (uint8_t *)(h + 1);
 	memset(ua, 0, ssi->user_alloc);
 	p = (char *)ua + ssi->user_alloc;
 	memcpy(p, ssi->streamtype, strlen(ssi->streamtype) + 1);
@@ -1070,7 +1070,7 @@ lws_sspc_cancel_timeout(struct lws_sspc_handle *h)
 void *
 lws_sspc_to_user_object(struct lws_sspc_handle *h)
 {
-	return (void *)&h[1];
+	return (void *)(h + 1);
 }
 
 void
diff --git a/lib/secure-streams/secure-streams.c b/lib/secure-streams/secure-streams.c
index 489543dba..510b01645 100644
--- a/lib/secure-streams/secure-streams.c
+++ b/lib/secure-streams/secure-streams.c
@@ -614,7 +614,7 @@ lws_smd_ss_cb(void *opaque, lws_smd_class_t _class,
 	lws_ser_wu64be(p + 8, (uint64_t)timestamp);
 
 	if (h->info.rx)
-		h->info.rx((void *)&h[1], p, len + LWS_SMD_SS_RX_HEADER_LEN,
+		h->info.rx((void *)(h + 1), p, len + LWS_SMD_SS_RX_HEADER_LEN,
 		      LWSSS_FLAG_SOM | LWSSS_FLAG_EOM);
 
 	return 0;
@@ -634,7 +634,7 @@ lws_ss_smd_tx_cb(lws_sorted_usec_list_t *sul)
 	if (!h->info.tx)
 		return;
 
-	n = h->info.tx(&h[1], h->txord++, buf, &len, &flags);
+	n = h->info.tx((h + 1), h->txord++, buf, &len, &flags);
 	if (n)
 		/* nonzero return means don't want to send anything */
 		return;
@@ -1072,7 +1072,7 @@ lws_ss_create(struct lws_context *context, int tsi, const lws_ss_info_t *ssi,
 		h->proxy_onward = 1;
 
 	/* start of overallocated area */
-	p = (char *)&h[1];
+	p = (char *)(h + 1);
 
 	/* set the handle pointer in the user data struct */
 	v = (void **)(p + ssi->handle_offset);
@@ -1350,7 +1350,7 @@ fail_creation:
 void *
 lws_ss_to_user_object(struct lws_ss_handle *h)
 {
-	return (void *)&h[1];
+	return (void *)(h + 1);
 }
 
 void