diff --git a/src/ap.c b/src/ap.c
index aa0f2511..f78863ad 100644
--- a/src/ap.c
+++ b/src/ap.c
@@ -688,7 +688,6 @@ static size_t ap_build_beacon_pr_head(struct ap_state *ap,
 					size_t out_len)
 {
 	struct mmpdu_header *mpdu = (void *) out_buf;
-	unsigned int len;
 	uint16_t capability = IE_BSS_CAP_ESS | IE_BSS_CAP_PRIVACY;
 	const uint8_t *bssid = netdev_get_address(ap->netdev);
 	uint32_t minr, maxr, count, r;
@@ -740,8 +739,8 @@ static size_t ap_build_beacon_pr_head(struct ap_state *ap,
 	ie_tlv_builder_next(&builder, IE_TYPE_DSSS_PARAMETER_SET);
 	ie_tlv_builder_set_data(&builder, &ap->channel, 1);
 
-	ie_tlv_builder_finalize(&builder, &len);
-	return 36 + len;
+	ie_tlv_builder_finalize(&builder, &out_len);
+	return 36 + out_len;
 }
 
 /* Beacon / Probe Response frame portion after the TIM IE */
diff --git a/src/fils.c b/src/fils.c
index 918e6cf8..bfb885ac 100644
--- a/src/fils.c
+++ b/src/fils.c
@@ -91,7 +91,6 @@ static void fils_erp_tx_func(const uint8_t *eap_data, size_t len,
 	struct ie_tlv_builder builder;
 	uint8_t data[256];
 	uint8_t *ptr = data;
-	unsigned int tlv_len;
 	struct ie_rsn_info rsn_info;
 	uint8_t *rsne;
 
@@ -133,9 +132,9 @@ static void fils_erp_tx_func(const uint8_t *eap_data, size_t len,
 						fils->hs->mde[1]);
 	}
 
-	ie_tlv_builder_finalize(&builder, &tlv_len);
+	ie_tlv_builder_finalize(&builder, &len);
 
-	fils->auth(data, ptr - data + tlv_len, fils->user_data);
+	fils->auth(data, ptr - data + len, fils->user_data);
 }
 
 static int fils_derive_key_data(struct fils_sm *fils)
@@ -153,7 +152,7 @@ static int fils_derive_key_data(struct fils_sm *fils)
 	size_t iov_elems = 0;
 	size_t fils_ft_len = 0;
 	bool sha384;
-	unsigned int ie_len;
+	size_t ie_len;
 	uint8_t *rsne = NULL;
 
 	rmsk = erp_get_rmsk(fils->erp, &rmsk_len);
diff --git a/src/ie.c b/src/ie.c
index edcdc35f..a73d5bbc 100644
--- a/src/ie.c
+++ b/src/ie.c
@@ -393,7 +393,7 @@ bool ie_tlv_builder_recurse(struct ie_tlv_builder *builder,
 }
 
 unsigned char *ie_tlv_builder_finalize(struct ie_tlv_builder *builder,
-			unsigned int *out_len)
+					size_t *out_len)
 {
 	unsigned int len = 0;
 
diff --git a/src/ie.h b/src/ie.h
index b7630156..87b43e92 100644
--- a/src/ie.h
+++ b/src/ie.h
@@ -497,7 +497,7 @@ bool ie_tlv_builder_set_data(struct ie_tlv_builder *builder,
 bool ie_tlv_builder_recurse(struct ie_tlv_builder *builder,
 			struct ie_tlv_builder *recurse);
 unsigned char *ie_tlv_builder_finalize(struct ie_tlv_builder *builder,
-			unsigned int *out_len);
+					size_t *out_len);
 
 uint32_t ie_rsn_cipher_suite_to_cipher(enum ie_rsn_cipher_suite suite);
 
diff --git a/unit/test-ie.c b/unit/test-ie.c
index 6dd074b5..709b7454 100644
--- a/unit/test-ie.c
+++ b/unit/test-ie.c
@@ -156,8 +156,10 @@ static int create_ie(int ie_count, struct ie_tlv_builder *builder,
 static void ie_test_writer(const void *data)
 {
 	struct test_data *test = (struct test_data *)data;
+	size_t expected_len = test->len;
 	struct ie_tlv_builder builder;
-	unsigned int final_len = 0, builder_len, expected_len = test->len;
+	size_t final_len = 0;
+	size_t builder_len;
 	const unsigned char *expected_buf = test->buf;
 	unsigned int ie_count = 0;
 	char *str;
@@ -250,7 +252,7 @@ static void ie_test_writer(const void *data)
 		assert(!memcmp(test->buf, expected_buf, final_len));
 	}
 
-	printf("Wrote %d IE total len %d\n", ie_count, expected_len);
+	printf("Wrote %d IE total len %zu\n", ie_count, expected_len);
 }
 
 static void ie_test_writer_invalid_tag(const void *data)
@@ -291,7 +293,7 @@ static void ie_test_reader_extended(const void *data)
 static void ie_test_writer_extended(const void *data)
 {
 	struct ie_tlv_builder builder;
-	unsigned int builder_len;
+	size_t builder_len;
 	static const uint8_t expected[] = {
 		0xff, 0x05, 0x0a, 0xff, 0x01, 0x02, 0x03,
 	};