diff --git a/poi-ooxml/src/main/java/org/apache/poi/poifs/crypt/dsig/SignatureConfig.java b/poi-ooxml/src/main/java/org/apache/poi/poifs/crypt/dsig/SignatureConfig.java
index eae8234b9f..5888732c47 100644
--- a/poi-ooxml/src/main/java/org/apache/poi/poifs/crypt/dsig/SignatureConfig.java
+++ b/poi-ooxml/src/main/java/org/apache/poi/poifs/crypt/dsig/SignatureConfig.java
@@ -118,12 +118,12 @@ public class SignatureConfig {
     private static final String XMLSEC_SANTUARIO = "org.apache.jcp.xml.dsig.internal.dom.XMLDSigRI";
     private static final String XMLSEC_JDK = "org.jcp.xml.dsig.internal.dom.XMLDSigRI";
 
-    private static final List<Supplier<SignatureFacet>> DEFAULT_FACETS = Arrays.asList(
+    private static final List<Supplier<SignatureFacet>> DEFAULT_FACETS = Collections.unmodifiableList(Arrays.asList(
         OOXMLSignatureFacet::new,
         KeyInfoSignatureFacet::new,
         XAdESSignatureFacet::new,
         Office2010SignatureFacet::new
-    );
+    ));
 
     private List<SignatureFacet> signatureFacets = new ArrayList<>();
     private HashAlgorithm digestAlgo = HashAlgorithm.sha256;
diff --git a/poi-ooxml/src/main/java/org/apache/poi/poifs/crypt/dsig/SignatureMarshalDefaultListener.java b/poi-ooxml/src/main/java/org/apache/poi/poifs/crypt/dsig/SignatureMarshalDefaultListener.java
index d3c43fd2b2..de6f6816a7 100644
--- a/poi-ooxml/src/main/java/org/apache/poi/poifs/crypt/dsig/SignatureMarshalDefaultListener.java
+++ b/poi-ooxml/src/main/java/org/apache/poi/poifs/crypt/dsig/SignatureMarshalDefaultListener.java
@@ -23,6 +23,7 @@ import static org.apache.poi.poifs.crypt.dsig.facets.SignatureFacet.XML_DIGSIG_N
 import static org.apache.poi.poifs.crypt.dsig.facets.SignatureFacet.XML_NS;
 
 import java.util.Arrays;
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
@@ -51,7 +52,8 @@ public class SignatureMarshalDefaultListener implements SignatureMarshalListener
     private static final String OBJECT_TAG = "Object";
     private static final Set<String> IGNORE_NS = new HashSet<>(Arrays.asList(null, XML_NS, XML_DIGSIG_NS));
 
-    private static final List<String> DIRECT_NS = Arrays.asList(OO_DIGSIG_NS, MS_DIGSIG_NS);
+    private static final List<String> DIRECT_NS = Collections.unmodifiableList(
+        Arrays.asList(OO_DIGSIG_NS, MS_DIGSIG_NS));
 
     @Override
     public void handleElement(SignatureInfo signatureInfo, Document doc, EventTarget target, EventListener parentListener) {