diff --git a/NEWS b/NEWS
index 894380cb67..db3192a824 100644
--- a/NEWS
+++ b/NEWS
@@ -164,6 +164,8 @@ Deprecated Functionality
 - ``internal_val()`` and ``internal_const_val()`` are deprecated, use
   ``zeek::lookup_val()`` or ``zeek::lookup_const()``.
 
+- ``internal_func()`` is deprecated, use ``zeek::lookup_func()``.
+
 Zeek 3.1.0
 ==========
 
diff --git a/src/Discard.cc b/src/Discard.cc
index 3e87ca0bc7..4386874ad8 100644
--- a/src/Discard.cc
+++ b/src/Discard.cc
@@ -16,10 +16,10 @@
 
 Discarder::Discarder()
 	{
-	check_ip = internal_func("discarder_check_ip");
-	check_tcp = internal_func("discarder_check_tcp");
-	check_udp = internal_func("discarder_check_udp");
-	check_icmp = internal_func("discarder_check_icmp");
+	check_ip = zeek::lookup_func("discarder_check_ip");
+	check_tcp = zeek::lookup_func("discarder_check_tcp");
+	check_udp = zeek::lookup_func("discarder_check_udp");
+	check_icmp = zeek::lookup_func("discarder_check_icmp");
 
 	discarder_maxlen = static_cast<int>(opt_internal_int("discarder_maxlen"));
 	}
diff --git a/src/Discard.h b/src/Discard.h
index 01b55d6e4a..ac69db845f 100644
--- a/src/Discard.h
+++ b/src/Discard.h
@@ -4,6 +4,8 @@
 
 #include <sys/types.h> // for u_char
 
+#include "IntrusivePtr.h"
+
 class IP_Hdr;
 class Val;
 class Func;
@@ -20,10 +22,10 @@ public:
 protected:
 	Val* BuildData(const u_char* data, int hdrlen, int len, int caplen);
 
-	Func* check_ip;
-	Func* check_tcp;
-	Func* check_udp;
-	Func* check_icmp;
+	IntrusivePtr<Func> check_ip;
+	IntrusivePtr<Func> check_tcp;
+	IntrusivePtr<Func> check_udp;
+	IntrusivePtr<Func> check_icmp;
 
 	// Maximum amount of application data passed to filtering functions.
 	int discarder_maxlen;
diff --git a/src/Var.cc b/src/Var.cc
index 95f36bec5f..c8d7fbc7c9 100644
--- a/src/Var.cc
+++ b/src/Var.cc
@@ -795,6 +795,19 @@ Func* internal_func(const char* name)
 		return nullptr;
 	}
 
+IntrusivePtr<Func> zeek::lookup_func(const char* name)
+	{
+	const auto& v = zeek::lookup_val(name);
+
+	if ( ! v )
+		return nullptr;
+
+	if ( ! IsFunc(v->Type()->Tag()) )
+		reporter->InternalError("Expected variable '%s' to be a function", name);
+
+	return {NewRef{}, v->AsFunc()};
+	}
+
 EventHandlerPtr internal_handler(const char* name)
 	{
 	// If there already is an entry in the registry, we have a
diff --git a/src/Var.h b/src/Var.h
index f9524e6ec1..569a1bf047 100644
--- a/src/Var.h
+++ b/src/Var.h
@@ -57,6 +57,7 @@ extern ListVal* internal_list_val(const char* name);
 [[deprecated("Remove in v4.1.  Use zeek::lookup_type().")]]
 extern BroType* internal_type(const char* name);
 
+[[deprecated("Remove in v4.1.  Use zeek::lookup_func().")]]
 extern Func* internal_func(const char* name);
 
 extern EventHandlerPtr internal_handler(const char* name);
@@ -99,4 +100,12 @@ const IntrusivePtr<Val>& lookup_val(const char* name);
  */
 const IntrusivePtr<Val>& lookup_const(const char* name);
 
+/**
+ * Lookup an ID by its name and return the function it references.
+ * A fatal occurs if the ID does not exist or if it is not a function.
+ * @param name  The identifier name to lookup
+ * @return  The current function value the identifier references.
+ */
+IntrusivePtr<Func> lookup_func(const char* name);
+
 } // namespace zeek