diff --git a/.changeset/tame-buckets-protect.md b/.changeset/tame-buckets-protect.md
new file mode 100644
index 000000000..efdc235ca
--- /dev/null
+++ b/.changeset/tame-buckets-protect.md
@@ -0,0 +1,5 @@
+---
+"@livekit/protocol": patch
+---
+
+Use string constant as parameter to twirp.NewErrorf
diff --git a/sip/sip.go b/sip/sip.go
index 0daa50792..514bc433d 100644
--- a/sip/sip.go
+++ b/sip/sip.go
@@ -777,7 +777,7 @@ func MatchDispatchRuleIter(trunk *livekit.SIPInboundTrunkInfo, rules iters.Iter[
 	}
 	if specificRuleCnt == 0 && defaultRuleCnt == 0 {
 		err := &ErrNoDispatchMatched{NoRules: true, NoTrunks: trunk == nil, CalledNumber: req.CalledNumber}
-		return nil, twirp.WrapError(twirp.NewErrorf(twirp.FailedPrecondition, err.Error()), err)
+		return nil, twirp.WrapError(twirp.NewErrorf(twirp.FailedPrecondition, "%s", err.Error()), err)
 	}
 	if specificRule != nil {
 		return specificRule, nil
@@ -786,7 +786,7 @@ func MatchDispatchRuleIter(trunk *livekit.SIPInboundTrunkInfo, rules iters.Iter[
 		return defaultRule, nil
 	}
 	err := &ErrNoDispatchMatched{NoRules: false, NoTrunks: trunk == nil, CalledNumber: req.CalledNumber}
-	return nil, twirp.WrapError(twirp.NewErrorf(twirp.FailedPrecondition, err.Error()), err)
+	return nil, twirp.WrapError(twirp.NewErrorf(twirp.FailedPrecondition, "%s", err.Error()), err)
 }
 
 // EvaluateDispatchRule checks a selected Dispatch Rule against the provided request.
diff --git a/utils/data_channel_rpc.go b/utils/data_channel_rpc.go
index 3ec3d330a..5828fe052 100644
--- a/utils/data_channel_rpc.go
+++ b/utils/data_channel_rpc.go
@@ -65,29 +65,29 @@ func (e *DataChannelRpcError) Error() string {
 func (e *DataChannelRpcError) PsrpcError() psrpc.Error {
 	switch e.Code {
 	case DataChannelRpcApplicationError:
-		return psrpc.NewErrorf(psrpc.Internal, e.Error())
+		return psrpc.NewErrorf(psrpc.Internal, "%s", e.Error())
 	case DataChannelRpcConnectionTimeout:
-		return psrpc.NewErrorf(psrpc.Canceled, e.Error())
+		return psrpc.NewErrorf(psrpc.Canceled, "%s", e.Error())
 	case DataChannelRpcResponseTimeout:
-		return psrpc.NewErrorf(psrpc.Canceled, e.Error())
+		return psrpc.NewErrorf(psrpc.Canceled, "%s", e.Error())
 	case DataChannelRpcRecipientDisconnected:
-		return psrpc.NewErrorf(psrpc.Unavailable, e.Error())
+		return psrpc.NewErrorf(psrpc.Unavailable, "%s", e.Error())
 	case DataChannelRpcResponsePayloadTooLarge:
-		return psrpc.NewErrorf(psrpc.MalformedResponse, e.Error())
+		return psrpc.NewErrorf(psrpc.MalformedResponse, "%s", e.Error())
 	case DataChannelRpcSendFailed:
-		return psrpc.NewErrorf(psrpc.Internal, e.Error())
+		return psrpc.NewErrorf(psrpc.Internal, "%s", e.Error())
 	case DataChannelRpcUnsupportedMethod:
-		return psrpc.NewErrorf(psrpc.InvalidArgument, e.Error())
+		return psrpc.NewErrorf(psrpc.InvalidArgument, "%s", e.Error())
 	case DataChannelRpcRecipientNotFound:
-		return psrpc.NewErrorf(psrpc.NotFound, e.Error())
+		return psrpc.NewErrorf(psrpc.NotFound, "%s", e.Error())
 	case DataChannelRpcRequestPayloadTooLarge:
-		return psrpc.NewErrorf(psrpc.MalformedRequest, e.Error())
+		return psrpc.NewErrorf(psrpc.MalformedRequest, "%s", e.Error())
 	case DataChannelRpcUnsupportedServer:
-		return psrpc.NewErrorf(psrpc.Unimplemented, e.Error())
+		return psrpc.NewErrorf(psrpc.Unimplemented, "%s", e.Error())
 	case DataChannelRpcUnsupportedVersion:
-		return psrpc.NewErrorf(psrpc.Unimplemented, e.Error())
+		return psrpc.NewErrorf(psrpc.Unimplemented, "%s", e.Error())
 	default:
-		return psrpc.NewErrorf(psrpc.Internal, e.Error())
+		return psrpc.NewErrorf(psrpc.Internal, "%s", e.Error())
 	}
 }