diff --git a/src/Conn.cc b/src/Conn.cc
index 8b017b5686..dc8b63bb9c 100644
--- a/src/Conn.cc
+++ b/src/Conn.cc
@@ -146,7 +146,7 @@ void Connection::CheckEncapsulation(const EncapsulationStack* arg_encap)
 			{
 			if ( tunnel_changed )
 				EnqueueEvent(tunnel_changed, nullptr, ConnVal(),
-				             IntrusivePtr{AdoptRef{}, arg_encap->GetVectorVal()});
+				             arg_encap->ToVal());
 
 			delete encapsulation;
 			encapsulation = new EncapsulationStack(*arg_encap);
@@ -158,8 +158,7 @@ void Connection::CheckEncapsulation(const EncapsulationStack* arg_encap)
 		if ( tunnel_changed )
 			{
 			EncapsulationStack empty;
-			EnqueueEvent(tunnel_changed, nullptr, ConnVal(),
-			             IntrusivePtr{AdoptRef{}, empty.GetVectorVal()});
+			EnqueueEvent(tunnel_changed, nullptr, ConnVal(), empty.ToVal());
 			}
 
 		delete encapsulation;
@@ -169,8 +168,7 @@ void Connection::CheckEncapsulation(const EncapsulationStack* arg_encap)
 	else if ( arg_encap )
 		{
 		if ( tunnel_changed )
-			EnqueueEvent(tunnel_changed, nullptr, ConnVal(),
-			             IntrusivePtr{AdoptRef{}, arg_encap->GetVectorVal()});
+			EnqueueEvent(tunnel_changed, nullptr, ConnVal(), arg_encap->ToVal());
 
 		encapsulation = new EncapsulationStack(*arg_encap);
 		}
@@ -390,7 +388,7 @@ const IntrusivePtr<RecordVal>& Connection::ConnVal()
 		conn_val->Assign(7, make_intrusive<StringVal>(uid.Base62("C").c_str()));
 
 		if ( encapsulation && encapsulation->Depth() > 0 )
-			conn_val->Assign(8, encapsulation->GetVectorVal());
+			conn_val->Assign(8, encapsulation->ToVal());
 
 		if ( vlan != 0 )
 			conn_val->Assign(9, val_mgr->Int(vlan));
diff --git a/src/TunnelEncapsulation.cc b/src/TunnelEncapsulation.cc
index 2f3deb9e14..2f58df3bd0 100644
--- a/src/TunnelEncapsulation.cc
+++ b/src/TunnelEncapsulation.cc
@@ -16,9 +16,9 @@ EncapsulatingConn::EncapsulatingConn(Connection* c, BifEnum::Tunnel::Type t)
 		}
 	}
 
-RecordVal* EncapsulatingConn::GetRecordVal() const
+IntrusivePtr<RecordVal> EncapsulatingConn::ToVal() const
 	{
-	RecordVal *rv = new RecordVal(BifType::Record::Tunnel::EncapsulatingConn);
+	auto rv = make_intrusive<RecordVal>(BifType::Record::Tunnel::EncapsulatingConn);
 
 	auto id_val = make_intrusive<RecordVal>(conn_id);
 	id_val->Assign(0, make_intrusive<AddrVal>(src_addr));
diff --git a/src/TunnelEncapsulation.h b/src/TunnelEncapsulation.h
index 4fc0d19b3e..106d5dfb74 100644
--- a/src/TunnelEncapsulation.h
+++ b/src/TunnelEncapsulation.h
@@ -3,6 +3,7 @@
 #pragma once
 
 #include "zeek-config.h"
+#include "IntrusivePtr.h"
 #include "NetVar.h"
 #include "IPAddr.h"
 #include "Var.h" // for internal_type()
@@ -79,7 +80,11 @@ public:
 	/**
 	 * Returns record value of type "EncapsulatingConn" representing the tunnel.
 	 */
-	RecordVal* GetRecordVal() const;
+	IntrusivePtr<RecordVal> ToVal() const;
+
+	[[deprecated("Remove in v4.1.  Use ToVal() instead.")]]
+	RecordVal* GetRecordVal() const
+		{ return ToVal().release(); }
 
 	friend bool operator==(const EncapsulatingConn& ec1,
 	                       const EncapsulatingConn& ec2)
@@ -190,20 +195,24 @@ public:
 	 * Get the value of type "EncapsulatingConnVector" represented by the
 	 * entire encapsulation chain.
 	 */
-	VectorVal* GetVectorVal() const
+	IntrusivePtr<VectorVal> ToVal() const
 		{
-		VectorVal* vv = new VectorVal(
+		auto vv = make_intrusive<VectorVal>(
 		    internal_type("EncapsulatingConnVector")->AsVectorType());
 
 		if ( conns )
 			{
 			for ( size_t i = 0; i < conns->size(); ++i )
-				vv->Assign(i, (*conns)[i].GetRecordVal());
+				vv->Assign(i, (*conns)[i].ToVal());
 			}
 
 		return vv;
 		}
 
+	[[deprecated("Remove in v4.1.  Use ToVal() instead.")]]
+	VectorVal* GetVectorVal() const
+		{ return ToVal().release(); }
+
 	friend bool operator==(const EncapsulationStack& e1,
 	                       const EncapsulationStack& e2);