diff --git a/libraries/provider_configure.rb b/libraries/provider_configure.rb
index 36c262fc3..a8ac24887 100644
--- a/libraries/provider_configure.rb
+++ b/libraries/provider_configure.rb
@@ -14,18 +14,19 @@ def whyrun_supported?
     es_install = find_es_resource(run_context, :elasticsearch_install, new_resource)
     es_svc = find_es_resource(run_context, :elasticsearch_service, new_resource)
 
+    default_configuration = new_resource.default_configuration.dup
     # if a subdir parameter is missing but dir is set, infer the subdir name
     # then go and be sure it's also set in the YML hash if it wasn't given there
-    if new_resource.path_conf[es_install.type] && new_resource.default_configuration['path.conf'].nil?
-      new_resource.default_configuration['path.conf'] = new_resource.path_conf[es_install.type]
+    if new_resource.path_conf[es_install.type] && default_configuration['path.conf'].nil?
+      default_configuration['path.conf'] = new_resource.path_conf[es_install.type]
     end
 
-    if new_resource.path_data[es_install.type] && new_resource.default_configuration['path.data'].nil?
-      new_resource.default_configuration['path.data'] = new_resource.path_data[es_install.type]
+    if new_resource.path_data[es_install.type] && default_configuration['path.data'].nil?
+      default_configuration['path.data'] = new_resource.path_data[es_install.type]
     end
 
-    if new_resource.path_logs[es_install.type] && new_resource.default_configuration['path.logs'].nil?
-      new_resource.default_configuration['path.logs'] = new_resource.path_logs[es_install.type]
+    if new_resource.path_logs[es_install.type] && default_configuration['path.logs'].nil?
+      default_configuration['path.logs'] = new_resource.path_logs[es_install.type]
     end
 
     # calculation for memory allocation; 50% or 31g, whatever is smaller
@@ -124,7 +125,7 @@ def whyrun_supported?
     logging_template.run_action(:create)
     new_resource.updated_by_last_action(true) if logging_template.updated_by_last_action?
 
-    merged_configuration = new_resource.default_configuration.merge(new_resource.configuration)
+    merged_configuration = default_configuration.merge(new_resource.configuration.dup)
     merged_configuration['#_seen'] = {} # magic state variable for what we've seen in a config
 
     # warn if someone is using symbols. we don't support.
diff --git a/libraries/resource_configure.rb b/libraries/resource_configure.rb
index 688c0f193..185775fca 100644
--- a/libraries/resource_configure.rb
+++ b/libraries/resource_configure.rb
@@ -13,31 +13,31 @@ class ElasticsearchCookbook::ConfigureResource < Chef::Resource::LWRPBase
   attribute(:path_home, kind_of: Hash, default: {
               package: '/usr/share/elasticsearch',
               tarball: '/usr/local/elasticsearch'
-            })
+            }.freeze)
   attribute(:path_conf, kind_of: Hash, default: {
               package: '/etc/elasticsearch',
               tarball: '/usr/local/etc/elasticsearch'
-            })
+            }.freeze)
   attribute(:path_data, kind_of: Hash, default: {
               package: '/usr/share/elasticsearch',
               tarball: '/usr/local/var/data/elasticsearch'
-            })
+            }.freeze)
   attribute(:path_logs, kind_of: Hash, default: {
               package: '/var/log/elasticsearch',
               tarball: '/usr/local/var/log/elasticsearch'
-            })
+            }.freeze)
   attribute(:path_pid, kind_of: Hash, default: {
               package: '/var/run/elasticsearch',
               tarball: '/usr/local/var/run'
-            })
+            }.freeze)
   attribute(:path_plugins, kind_of: Hash, default: {
               package: '/usr/share/elasticsearch/plugins',
               tarball: '/usr/local/elasticsearch/plugins'
-            })
+            }.freeze)
   attribute(:path_bin, kind_of: Hash, default: {
               package: '/usr/share/elasticsearch/bin',
               tarball: '/usr/local/bin'
-            })
+            }.freeze)
 
   attribute(:template_elasticsearch_env, kind_of: String, default: 'elasticsearch.in.sh.erb')
   attribute(:cookbook_elasticsearch_env, kind_of: String, default: 'elasticsearch')
@@ -48,7 +48,7 @@ class ElasticsearchCookbook::ConfigureResource < Chef::Resource::LWRPBase
   attribute(:template_logging_yml, kind_of: String, default: 'logging.yml.erb')
   attribute(:cookbook_logging_yml, kind_of: String, default: 'elasticsearch')
 
-  attribute(:logging, kind_of: Hash, default: {})
+  attribute(:logging, kind_of: Hash, default: {}.freeze)
 
   attribute(:java_home, kind_of: String, default: nil)
 
@@ -103,11 +103,11 @@ class ElasticsearchCookbook::ConfigureResource < Chef::Resource::LWRPBase
               'gateway.expected_nodes' => 0,
 
               'http.port' => 9200
-            })
+            }.freeze)
 
   # These settings are merged with the `default_configuration` attribute,
   # allowing you to override and set specific settings. Unless you intend to
   # wipe out all default settings, your configuration items should go here.
   #
-  attribute(:configuration, kind_of: Hash, default: {})
+  attribute(:configuration, kind_of: Hash, default: {}.freeze)
 end
diff --git a/libraries/resource_install.rb b/libraries/resource_install.rb
index 80dea99f2..bc517d7cb 100644
--- a/libraries/resource_install.rb
+++ b/libraries/resource_install.rb
@@ -25,7 +25,7 @@ class ElasticsearchCookbook::InstallResource < Chef::Resource::LWRPBase
   attribute(:dir, kind_of: Hash, default: {
               package: '/usr/share',
               tarball: '/usr/local'
-            })
+            }.freeze)
 
   # attributes used by the package-flavor provider
   attribute(:package_options, kind_of: String, default: nil)
diff --git a/libraries/resource_service.rb b/libraries/resource_service.rb
index c6466ff12..ace872540 100644
--- a/libraries/resource_service.rb
+++ b/libraries/resource_service.rb
@@ -16,7 +16,7 @@ class ElasticsearchCookbook::ServiceResource < Chef::Resource::LWRPBase
   attribute(:args, kind_of: String, default: '-d')
 
   # service actions
-  attribute(:service_actions, kind_of: [Symbol, Array], default: [:enable])
+  attribute(:service_actions, kind_of: [Symbol, Array], default: [:enable].freeze)
 
   # allow overridable init script
   attribute(:init_source, kind_of: String, default: 'initscript.erb')