diff --git a/lib/ESPAsyncWebServer/AsyncJson.h b/lib/ESPAsyncWebServer/AsyncJson.h
index 64f9643ef..f005f6ea5 100644
--- a/lib/ESPAsyncWebServer/AsyncJson.h
+++ b/lib/ESPAsyncWebServer/AsyncJson.h
@@ -70,7 +70,7 @@ class MsgpackAsyncJsonResponse : public AsyncAbstractResponse {
 
     ~MsgpackAsyncJsonResponse() {
     }
-    JsonVariant & getRoot() {
+    JsonVariant getRoot() {
         return _root;
     }
     bool _sourceValid() const {
@@ -114,7 +114,7 @@ class AsyncJsonResponse : public AsyncAbstractResponse {
 
     ~AsyncJsonResponse() {
     }
-    JsonVariant & getRoot() {
+    JsonVariant getRoot() {
         return _root;
     }
     bool _sourceValid() const {
@@ -158,7 +158,7 @@ class PrettyAsyncJsonResponse : public AsyncJsonResponse {
     }
 };
 
-typedef std::function<void(AsyncWebServerRequest * request, JsonVariant & json)> ArJsonRequestHandlerFunction;
+typedef std::function<void(AsyncWebServerRequest * request, JsonVariant json)> ArJsonRequestHandlerFunction;
 
 class AsyncCallbackJsonWebHandler : public AsyncWebHandler {
   private:
diff --git a/lib/framework/AuthenticationService.cpp b/lib/framework/AuthenticationService.cpp
index 005065a94..fd316a87c 100644
--- a/lib/framework/AuthenticationService.cpp
+++ b/lib/framework/AuthenticationService.cpp
@@ -25,7 +25,7 @@ void AuthenticationService::verifyAuthorization(AsyncWebServerRequest * request)
  * Signs in a user if the username and password match. Provides a JWT to be used in the Authorization header in
  * subsequent requests.
  */
-void AuthenticationService::signIn(AsyncWebServerRequest * request, JsonVariant & json) {
+void AuthenticationService::signIn(AsyncWebServerRequest * request, JsonVariant json) {
     if (json.is<JsonObject>()) {
         String         username       = json["username"];
         String         password       = json["password"];
diff --git a/lib/framework/AuthenticationService.h b/lib/framework/AuthenticationService.h
index 60ed100b6..d8a823485 100644
--- a/lib/framework/AuthenticationService.h
+++ b/lib/framework/AuthenticationService.h
@@ -21,7 +21,7 @@ class AuthenticationService {
     AsyncCallbackJsonWebHandler _signInHandler;
 
     // endpoint functions
-    void signIn(AsyncWebServerRequest * request, JsonVariant & json);
+    void signIn(AsyncWebServerRequest * request, JsonVariant json);
     void verifyAuthorization(AsyncWebServerRequest * request);
 };
 
diff --git a/lib/framework/HttpEndpoint.h b/lib/framework/HttpEndpoint.h
index 794cbe225..82546515f 100644
--- a/lib/framework/HttpEndpoint.h
+++ b/lib/framework/HttpEndpoint.h
@@ -83,7 +83,7 @@ class HttpPostEndpoint {
     StatefulService<T> *        _statefulService;
     AsyncCallbackJsonWebHandler _updateHandler;
 
-    void updateSettings(AsyncWebServerRequest * request, JsonVariant & json) {
+    void updateSettings(AsyncWebServerRequest * request, JsonVariant json) {
         if (!json.is<JsonObject>()) {
             request->send(400);
             return;
diff --git a/lib/framework/NTPSettingsService.cpp b/lib/framework/NTPSettingsService.cpp
index 751de6751..e1a4aa1c5 100644
--- a/lib/framework/NTPSettingsService.cpp
+++ b/lib/framework/NTPSettingsService.cpp
@@ -61,7 +61,7 @@ void NTPSettingsService::configureNTP() {
     }
 }
 
-void NTPSettingsService::configureTime(AsyncWebServerRequest * request, JsonVariant & json) {
+void NTPSettingsService::configureTime(AsyncWebServerRequest * request, JsonVariant json) {
     if (json.is<JsonObject>()) {
         struct tm tm        = {0};
         String    timeLocal = json["local_time"];
diff --git a/lib/framework/NTPSettingsService.h b/lib/framework/NTPSettingsService.h
index ab00b36d7..e18800fa1 100644
--- a/lib/framework/NTPSettingsService.h
+++ b/lib/framework/NTPSettingsService.h
@@ -67,7 +67,7 @@ class NTPSettingsService : public StatefulService<NTPSettings> {
     bool connected_ = false;
     void WiFiEvent(WiFiEvent_t event);
     void configureNTP();
-    void configureTime(AsyncWebServerRequest * request, JsonVariant & json);
+    void configureTime(AsyncWebServerRequest * request, JsonVariant json);
 };
 
 #endif
diff --git a/lib/framework/SecuritySettingsService.cpp b/lib/framework/SecuritySettingsService.cpp
index f17f5f4f1..9b5ab85c6 100644
--- a/lib/framework/SecuritySettingsService.cpp
+++ b/lib/framework/SecuritySettingsService.cpp
@@ -101,7 +101,7 @@ ArRequestHandlerFunction SecuritySettingsService::wrapRequest(ArRequestHandlerFu
 }
 
 ArJsonRequestHandlerFunction SecuritySettingsService::wrapCallback(ArJsonRequestHandlerFunction onRequest, AuthenticationPredicate predicate) {
-    return [this, onRequest, predicate](AsyncWebServerRequest * request, JsonVariant & json) {
+    return [this, onRequest, predicate](AsyncWebServerRequest * request, JsonVariant json) {
         Authentication authentication = authenticateRequest(request);
         if (!predicate(authentication)) {
             request->send(401);
diff --git a/lib_standalone/AsyncJson.h b/lib_standalone/AsyncJson.h
index 858b17082..6ab5a5c35 100644
--- a/lib_standalone/AsyncJson.h
+++ b/lib_standalone/AsyncJson.h
@@ -59,7 +59,7 @@ class PrettyAsyncJsonResponse {
     ~PrettyAsyncJsonResponse() {
     }
 
-    JsonVariant & getRoot() {
+    JsonVariant getRoot() {
         return _root;
     }
 
@@ -104,7 +104,7 @@ class MsgpackAsyncJsonResponse {
     ~MsgpackAsyncJsonResponse() {
     }
 
-    JsonVariant & getRoot() {
+    JsonVariant getRoot() {
         return _root;
     }
 
@@ -150,7 +150,7 @@ class AsyncJsonResponse {
     ~AsyncJsonResponse() {
     }
 
-    JsonVariant & getRoot() {
+    JsonVariant getRoot() {
         return _root;
     }
 
@@ -177,7 +177,7 @@ class AsyncJsonResponse {
     }
 };
 
-typedef std::function<void(AsyncWebServerRequest * request, JsonVariant & json)> ArJsonRequestHandlerFunction;
+typedef std::function<void(AsyncWebServerRequest * request, JsonVariant json)> ArJsonRequestHandlerFunction;
 
 class AsyncCallbackJsonWebHandler : public AsyncWebHandler {
   private:
diff --git a/lib_standalone/HttpEndpoint.h b/lib_standalone/HttpEndpoint.h
index c1cbaa535..e3fae9ba0 100644
--- a/lib_standalone/HttpEndpoint.h
+++ b/lib_standalone/HttpEndpoint.h
@@ -67,7 +67,7 @@ class HttpPostEndpoint {
     JsonStateUpdater<T>  _stateUpdater;
     StatefulService<T> * _statefulService;
 
-    void updateSettings(AsyncWebServerRequest * request, JsonVariant & json) {
+    void updateSettings(AsyncWebServerRequest * request, JsonVariant json) {
         if (!json.is<JsonObject>()) {
             return;
         }
diff --git a/lib_standalone/SecuritySettingsService.cpp b/lib_standalone/SecuritySettingsService.cpp
index dc5f3860c..7cc393418 100644
--- a/lib_standalone/SecuritySettingsService.cpp
+++ b/lib_standalone/SecuritySettingsService.cpp
@@ -100,7 +100,7 @@ ArRequestHandlerFunction SecuritySettingsService::wrapRequest(ArRequestHandlerFu
 }
 
 ArJsonRequestHandlerFunction SecuritySettingsService::wrapCallback(ArJsonRequestHandlerFunction onRequest, AuthenticationPredicate predicate) {
-    return [this, onRequest, predicate](AsyncWebServerRequest * request, JsonVariant & json) {
+    return [this, onRequest, predicate](AsyncWebServerRequest * request, JsonVariant json) {
         Authentication authentication = authenticateRequest(request);
         if (!predicate(authentication)) {
             request->send(401);
diff --git a/src/web/WebAPIService.cpp b/src/web/WebAPIService.cpp
index 4dc52fa53..8993fb56a 100644
--- a/src/web/WebAPIService.cpp
+++ b/src/web/WebAPIService.cpp
@@ -53,7 +53,7 @@ void WebAPIService::webAPIService_get(AsyncWebServerRequest * request) {
 // For HTTP POSTS with an optional JSON body
 // HTTP_POST | HTTP_PUT | HTTP_PATCH
 // POST /{device}[/{hc|id}][/{name}]
-void WebAPIService::webAPIService_post(AsyncWebServerRequest * request, JsonVariant & json) {
+void WebAPIService::webAPIService_post(AsyncWebServerRequest * request, JsonVariant json) {
     // if no body then treat it as a secure GET
     if (!json.is<JsonObject>()) {
         webAPIService_get(request);
diff --git a/src/web/WebAPIService.h b/src/web/WebAPIService.h
index a7781102d..aa8dd28cb 100644
--- a/src/web/WebAPIService.h
+++ b/src/web/WebAPIService.h
@@ -31,8 +31,8 @@ class WebAPIService {
   public:
     WebAPIService(AsyncWebServer * server, SecurityManager * securityManager);
 
-    void webAPIService_post(AsyncWebServerRequest * request, JsonVariant & json); // for POSTs
-    void webAPIService_get(AsyncWebServerRequest * request);                      // for GETs
+    void webAPIService_post(AsyncWebServerRequest * request, JsonVariant json); // for POSTs
+    void webAPIService_get(AsyncWebServerRequest * request);                    // for GETs
 
     static uint32_t api_count() {
         return api_count_;
diff --git a/src/web/WebCustomizationService.cpp b/src/web/WebCustomizationService.cpp
index 0b0b94200..2c39b2689 100644
--- a/src/web/WebCustomizationService.cpp
+++ b/src/web/WebCustomizationService.cpp
@@ -239,7 +239,7 @@ void WebCustomizationService::device_entities(AsyncWebServerRequest * request) {
 // takes a list of updated entities with new masks from the web UI
 // saves it in the customization service
 // and updates the entity list real-time
-void WebCustomizationService::customization_entities(AsyncWebServerRequest * request, JsonVariant & json) {
+void WebCustomizationService::customization_entities(AsyncWebServerRequest * request, JsonVariant json) {
     bool need_reboot = false;
     if (json.is<JsonObject>()) {
         // find the device using the unique_id
diff --git a/src/web/WebCustomizationService.h b/src/web/WebCustomizationService.h
index 40a390428..1b4bc8127 100644
--- a/src/web/WebCustomizationService.h
+++ b/src/web/WebCustomizationService.h
@@ -97,7 +97,7 @@ class WebCustomizationService : public StatefulService<WebCustomization> {
     void device_entities(AsyncWebServerRequest * request);
 
     // POST
-    void customization_entities(AsyncWebServerRequest * request, JsonVariant & json);
+    void customization_entities(AsyncWebServerRequest * request, JsonVariant json);
     void reset_customization(AsyncWebServerRequest * request); // command
 
     AsyncCallbackJsonWebHandler _masked_entities_handler;
diff --git a/src/web/WebDataService.cpp b/src/web/WebDataService.cpp
index 9dd41595d..f1f8ab1b4 100644
--- a/src/web/WebDataService.cpp
+++ b/src/web/WebDataService.cpp
@@ -227,7 +227,7 @@ void WebDataService::device_data(AsyncWebServerRequest * request) {
 }
 
 // assumes the service has been checked for admin authentication
-void WebDataService::write_device_value(AsyncWebServerRequest * request, JsonVariant & json) {
+void WebDataService::write_device_value(AsyncWebServerRequest * request, JsonVariant json) {
     if (json.is<JsonObject>()) {
         uint8_t      unique_id = json["id"]; // unique ID
         const char * cmd       = json["c"];  // the command
@@ -323,7 +323,7 @@ void WebDataService::write_device_value(AsyncWebServerRequest * request, JsonVar
 
 // takes a temperaturesensor name and optional offset from the WebUI and update the customization settings
 // via the temperaturesensor service
-void WebDataService::write_temperature_sensor(AsyncWebServerRequest * request, JsonVariant & json) {
+void WebDataService::write_temperature_sensor(AsyncWebServerRequest * request, JsonVariant json) {
     bool ok = false;
     if (json.is<JsonObject>()) {
         JsonObject sensor = json;
@@ -346,7 +346,7 @@ void WebDataService::write_temperature_sensor(AsyncWebServerRequest * request, J
 }
 
 // update the analog record, or create a new one
-void WebDataService::write_analog_sensor(AsyncWebServerRequest * request, JsonVariant & json) {
+void WebDataService::write_analog_sensor(AsyncWebServerRequest * request, JsonVariant json) {
     bool ok = false;
     if (json.is<JsonObject>()) {
         JsonObject analog = json;
diff --git a/src/web/WebDataService.h b/src/web/WebDataService.h
index 68902e45d..ada443d1f 100644
--- a/src/web/WebDataService.h
+++ b/src/web/WebDataService.h
@@ -47,9 +47,9 @@ class WebDataService {
     void device_data(AsyncWebServerRequest * request);
 
     // POST
-    void write_device_value(AsyncWebServerRequest * request, JsonVariant & json);
-    void write_temperature_sensor(AsyncWebServerRequest * request, JsonVariant & json);
-    void write_analog_sensor(AsyncWebServerRequest * request, JsonVariant & json);
+    void write_device_value(AsyncWebServerRequest * request, JsonVariant json);
+    void write_temperature_sensor(AsyncWebServerRequest * request, JsonVariant json);
+    void write_analog_sensor(AsyncWebServerRequest * request, JsonVariant json);
     void scan_devices(AsyncWebServerRequest * request); // command
 
     AsyncCallbackJsonWebHandler _write_value_handler, _write_temperature_handler, _write_analog_handler;
diff --git a/src/web/WebLogService.cpp b/src/web/WebLogService.cpp
index cd8f47266..703b2d9a3 100644
--- a/src/web/WebLogService.cpp
+++ b/src/web/WebLogService.cpp
@@ -211,7 +211,7 @@ void WebLogService::fetchLog(AsyncWebServerRequest * request) {
 }
 
 // sets the values like level after a POST
-void WebLogService::setValues(AsyncWebServerRequest * request, JsonVariant & json) {
+void WebLogService::setValues(AsyncWebServerRequest * request, JsonVariant json) {
     if (!json.is<JsonObject>()) {
         return;
     }
diff --git a/src/web/WebLogService.h b/src/web/WebLogService.h
index ce3630e94..083b10fdc 100644
--- a/src/web/WebLogService.h
+++ b/src/web/WebLogService.h
@@ -64,7 +64,7 @@ class WebLogService : public uuid::log::Handler {
 
     char * messagetime(char * out, const uint64_t t, const size_t bufsize);
 
-    void setValues(AsyncWebServerRequest * request, JsonVariant & json);
+    void setValues(AsyncWebServerRequest * request, JsonVariant json);
 
     AsyncCallbackJsonWebHandler setValues_; // for POSTs