diff --git a/ext/openssl/ossl_config.c b/ext/openssl/ossl_config.c
index 203d7ef29..94a2fc631 100644
--- a/ext/openssl/ossl_config.c
+++ b/ext/openssl/ossl_config.c
@@ -87,6 +87,7 @@ config_s_parse(VALUE klass, VALUE str)
 
     bio = ossl_obj2bio(&str);
     config_load_bio(conf, bio); /* Consumes BIO */
+    rb_obj_freeze(obj);
     return obj;
 }
 
@@ -144,6 +145,7 @@ config_initialize(int argc, VALUE *argv, VALUE self)
             ossl_raise(eConfigError, "BIO_new_file");
         config_load_bio(conf, bio); /* Consumes BIO */
     }
+    rb_obj_freeze(self);
     return self;
 }
 
@@ -158,6 +160,7 @@ config_initialize_copy(VALUE self, VALUE other)
     rb_check_frozen(self);
     bio = ossl_obj2bio(&str);
     config_load_bio(conf, bio); /* Consumes BIO */
+    rb_obj_freeze(self);
     return self;
 }
 
diff --git a/test/openssl/test_config.rb b/test/openssl/test_config.rb
index 6dbb9c613..f165ca493 100644
--- a/test/openssl/test_config.rb
+++ b/test/openssl/test_config.rb
@@ -39,6 +39,7 @@ def test_s_parse
     assert_equal("[ default ]\n\n", c.to_s)
     c = OpenSSL::Config.parse(@it.to_s)
     assert_equal(['CA_default', 'ca', 'default'], c.sections.sort)
+    assert_predicate(c, :frozen?)
   end
 
   def test_s_parse_format
@@ -188,6 +189,7 @@ def test_initialize
     c = OpenSSL::Config.new
     assert_equal("", c.to_s)
     assert_equal([], c.sections)
+    assert_predicate(c, :frozen?)
   end
 
   def test_initialize_with_empty_file
@@ -268,8 +270,10 @@ def test_inspect
   def test_dup
     assert_equal(['CA_default', 'ca', 'default'], @it.sections.sort)
     c1 = @it.dup
+    assert_predicate(c1, :frozen?)
     assert_equal(@it.sections.sort, c1.sections.sort)
     c2 = @it.clone
+    assert_predicate(c2, :frozen?)
     assert_equal(@it.sections.sort, c2.sections.sort)
   end