diff --git a/lib/secure-streams/protocols/ss-h2.c b/lib/secure-streams/protocols/ss-h2.c
index 3d1aa9c23..910067ab7 100644
--- a/lib/secure-streams/protocols/ss-h2.c
+++ b/lib/secure-streams/protocols/ss-h2.c
@@ -52,7 +52,7 @@ secstream_h2(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 			 */
 			lwsl_info("%s: reporting initial tx cr from server %d\n",
 				  __func__, wsi->txc.tx_cr);
-			ss_proxy_onward_txcr((void *)&h[1], wsi->txc.tx_cr);
+			ss_proxy_onward_txcr((void *)(h + 1), wsi->txc.tx_cr);
 		}
 #endif
 
@@ -106,7 +106,7 @@ secstream_h2(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 #if defined(LWS_WITH_SECURE_STREAMS_PROXY_API)
 		if (h->being_serialized)
 			/* we are the proxy-side SS for a remote client */
-			ss_proxy_onward_txcr((void *)&h[1], (int)len);
+			ss_proxy_onward_txcr((void *)(h + 1), (int)len);
 #endif
 		break;
 
diff --git a/lib/secure-streams/secure-streams.c b/lib/secure-streams/secure-streams.c
index 57a42a88f..5c3daa37c 100644
--- a/lib/secure-streams/secure-streams.c
+++ b/lib/secure-streams/secure-streams.c
@@ -608,7 +608,7 @@ lws_smd_ss_cb(void *opaque, lws_smd_class_t _class,
 	lws_ser_wu64be(p + 8, (uint64_t)timestamp);
 
 	if (h->info.rx)
-		h->info.rx((void *)&h[1], p, len + LWS_SMD_SS_RX_HEADER_LEN,
+		h->info.rx((void *)(h + 1), p, len + LWS_SMD_SS_RX_HEADER_LEN,
 		      LWSSS_FLAG_SOM | LWSSS_FLAG_EOM);
 
 	return 0;
@@ -628,7 +628,7 @@ lws_ss_smd_tx_cb(lws_sorted_usec_list_t *sul)
 	if (!h->info.tx)
 		return;
 
-	n = h->info.tx(&h[1], h->txord++, buf, &len, &flags);
+	n = h->info.tx(h + 1, h->txord++, buf, &len, &flags);
 	if (n)
 		/* nonzero return means don't want to send anything */
 		return;
@@ -1122,7 +1122,7 @@ lws_ss_create(struct lws_context *context, int tsi, const lws_ss_info_t *ssi,
 		h->proxy_onward = 1;
 
 	/* start of overallocated area */
-	p = (char *)&h[1];
+	p = (char *)(h + 1);
 
 	/* set the handle pointer in the user data struct */
 	v = (void **)(p + ssi->handle_offset);
@@ -1389,7 +1389,7 @@ fail_creation:
 void *
 lws_ss_to_user_object(struct lws_ss_handle *h)
 {
-	return (void *)&h[1];
+	return (void *)(h + 1);
 }
 
 void
diff --git a/lib/secure-streams/serialized/client/sspc-transport.c b/lib/secure-streams/serialized/client/sspc-transport.c
index f19e429cd..d1120585a 100644
--- a/lib/secure-streams/serialized/client/sspc-transport.c
+++ b/lib/secure-streams/serialized/client/sspc-transport.c
@@ -210,7 +210,7 @@ lws_sspc_txp_rx_from_proxy(lws_transport_priv_t txp_priv, const uint8_t *in,
 				 size_t len)
 {
 	lws_sspc_handle_t *h = (lws_sspc_handle_t *)txp_priv;
-	void *m = (void *)((uint8_t *)&h[1]);
+	void *m = (void *)((uint8_t *)(h + 1));
 
 	assert(h);
 
@@ -229,7 +229,7 @@ lws_ss_state_return_t
 lws_sspc_txp_tx(lws_sspc_handle_t *h, size_t metadata_limit)
 {
 	uint8_t *pkt = NULL, *p = NULL, *end = NULL;
-	void *m = (void *)((uint8_t *)&h[1]);
+	void *m = (void *)((uint8_t *)(h + 1));
 	lws_ss_state_return_t r;
 	uint8_t _s[64 + LWS_PRE], *s = _s + LWS_PRE, *cp = s;
 	size_t txl, len;
diff --git a/lib/secure-streams/serialized/client/sspc.c b/lib/secure-streams/serialized/client/sspc.c
index d9669e6f1..187d1dfdc 100644
--- a/lib/secure-streams/serialized/client/sspc.c
+++ b/lib/secure-streams/serialized/client/sspc.c
@@ -273,7 +273,7 @@ lws_sspc_event_helper(lws_sspc_handle_t *h, lws_ss_constate_t cs,
 		return LWSSSSRET_OK;
 
 	h->h_in_svc = h;
-	ret = h->ssi.state((void *)((uint8_t *)&h[1]), NULL, cs, flags);
+	ret = h->ssi.state((void *)((uint8_t *)(h + 1)), NULL, cs, flags);
 	h->h_in_svc = NULL;
 
 	return ret;
@@ -343,7 +343,7 @@ lws_sspc_create(struct lws_context *context, int tsi, const lws_ss_info_t *ssi,
 					       h->txp_path.ops_onw->name);
 
 	memcpy(&h->ssi, ssi, sizeof(*ssi));
-	ua = (uint8_t *)&h[1];
+	ua = (uint8_t *)(h + 1);
 	memset(ua, 0, ssi->user_alloc);
 	p = (char *)ua + ssi->user_alloc;
 	memcpy(p, ssi->streamtype, strlen(ssi->streamtype) + 1);
@@ -788,7 +788,7 @@ lws_sspc_cancel_timeout(struct lws_sspc_handle *h)
 void *
 lws_sspc_to_user_object(struct lws_sspc_handle *h)
 {
-	return (void *)&h[1];
+	return (void *)(h + 1);
 }
 
 struct lws_log_cx *