diff --git a/src/Val.cc b/src/Val.cc
index 38c952a294..f6c0e2ec18 100644
--- a/src/Val.cc
+++ b/src/Val.cc
@@ -2348,7 +2348,7 @@ void TableVal::DoExpire(double t)
 			if ( expire_func )
 				{
 				idx = RecoverIndex(k);
-				double secs = CallExpireFunc(idx->Ref());
+				double secs = CallExpireFunc({NewRef{}, idx});
 
 				// It's possible that the user-provided
 				// function modified or deleted the table
@@ -2439,13 +2439,10 @@ double TableVal::GetExpireTime()
 	return -1;
 	}
 
-double TableVal::CallExpireFunc(Val* idx)
+double TableVal::CallExpireFunc(IntrusivePtr<Val> idx)
 	{
 	if ( ! expire_func )
-		{
-		Unref(idx);
 		return 0;
-		}
 
 	double secs = 0;
 
@@ -2454,16 +2451,12 @@ double TableVal::CallExpireFunc(Val* idx)
 		auto vf = expire_func->Eval(nullptr);
 
 		if ( ! vf )
-			{
 			// Will have been reported already.
-			Unref(idx);
 			return 0;
-			}
 
 		if ( vf->Type()->Tag() != TYPE_FUNC )
 			{
 			vf->Error("not a function");
-			Unref(idx);
 			return 0;
 			}
 
@@ -2481,25 +2474,19 @@ double TableVal::CallExpireFunc(Val* idx)
 				{
 				for ( const auto& v : *idx->AsListVal()->Vals() )
 					vl.append(v->Ref());
-
-				Unref(idx);
 				}
 			else
 				{
 				ListVal* idx_list = idx->AsListVal();
 				// Flatten if only one element
 				if ( idx_list->Length() == 1 )
-					{
-					Val* old = idx;
-					idx = idx_list->Index(0)->Ref();
-					Unref(old);
-					}
+					idx = {NewRef{}, idx_list->Index(0)};
 
-				vl.append(idx);
+				vl.append(idx.release());
 				}
 			}
 		else
-			vl.append(idx);
+			vl.append(idx.release());
 
 		auto result = f->Call(&vl);
 
diff --git a/src/Val.h b/src/Val.h
index bc2f440eac..7b8aad5e26 100644
--- a/src/Val.h
+++ b/src/Val.h
@@ -851,8 +851,7 @@ protected:
 	double GetExpireTime();
 
 	// Calls &expire_func and returns its return interval;
-	// takes ownership of the reference.
-	double CallExpireFunc(Val *idx);
+	double CallExpireFunc(IntrusivePtr<Val> idx);
 
 	// Enum for the different kinds of changes an &on_change handler can see
 	enum OnChangeType { ELEMENT_NEW, ELEMENT_CHANGED, ELEMENT_REMOVED, ELEMENT_EXPIRED };