diff --git a/data.c b/data.c
index bc85171..d3605ef 100644
--- a/data.c
+++ b/data.c
@@ -1017,7 +1017,7 @@ xs_list *timeline_top_level(snac *snac, xs_list *list)
     while (xs_list_iter(&p, &v)) {
         char line[256] = "";
 
-        strcpy(line, v);
+        strncpy(line, v, sizeof(line));
 
         for (;;) {
             char line2[256];
@@ -1031,7 +1031,7 @@ xs_list *timeline_top_level(snac *snac, xs_list *list)
                 break;
 
             /* it's here! try again with its own parent */
-            strcpy(line, line2);
+            strncpy(line, line2, sizeof(line));
         }
 
         xs_set_add(&seen, line);
diff --git a/mastoapi.c b/mastoapi.c
index d185627..af8fb27 100644
--- a/mastoapi.c
+++ b/mastoapi.c
@@ -1064,7 +1064,7 @@ int mastoapi_get_handler(const xs_dict *req, const char *q_path,
                     char pid[64];
 
                     /* build the [grand]parent list, moving up */
-                    strcpy(pid, id);
+                    strncpy(pid, id, sizeof(pid));
 
                     while (object_parent(pid, pid, sizeof(pid))) {
                         xs *m2 = NULL;