diff --git a/NEWS.md b/NEWS.md
index 4927d713..ae4ca56a 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -3,6 +3,8 @@
 * `xml_find_int()` analogous to `xml_find_num()` for returning integers 
   matched by an XPath (#365, @michaelchirico).
 
+* Fix format string issues detected in R-devel.
+
 * `xml_serialize()` now includes the document type so that `xml_unserialize()` works also for HTML documents (#407, @HenrikBengtsson).
 
 * Remove unused dependencies on glue, withr and lifecycle (@mgirlich).
diff --git a/src/xml2_init.cpp b/src/xml2_init.cpp
index b89c64aa..906dbc93 100644
--- a/src/xml2_init.cpp
+++ b/src/xml2_init.cpp
@@ -34,7 +34,7 @@ void handleGenericError(void *ctx, const char *fmt, ...)
 
   va_start(arg, fmt);
   vsnprintf(buffer, BUFSIZ, fmt, arg);
-  Rf_error(buffer);
+  Rf_error("%s", buffer);
 }
 
 // [[export]]
diff --git a/src/xml2_output.cpp b/src/xml2_output.cpp
index c0619e23..df267142 100644
--- a/src/xml2_output.cpp
+++ b/src/xml2_output.cpp
@@ -92,7 +92,7 @@ int xml_write_callback(SEXP con, const char * buffer, int len) {
   size_t write_size;
 
   if ((write_size = R_WriteConnection(con, (void *) buffer, len)) != static_cast<size_t>(len)) {
-    Rf_error("write failed, expected %l, got %l", len, write_size);
+    Rf_error("write failed, expected %i, got %li", len, write_size);
   }
   return write_size;
 }