diff --git a/aux/bifcl b/aux/bifcl
index 2c7ded074f..31f7e04b0d 160000
--- a/aux/bifcl
+++ b/aux/bifcl
@@ -1 +1 @@
-Subproject commit 2c7ded074fdea124fcae7845d1f8e77879925270
+Subproject commit 31f7e04b0da5cfa65211208c64ac62874a065fc6
diff --git a/src/EventLauncher.cc b/src/EventLauncher.cc
index cc32efe59e..293869c0f7 100644
--- a/src/EventLauncher.cc
+++ b/src/EventLauncher.cc
@@ -4,5 +4,6 @@
 #include "Event.h"
 #include "NetVar.h"
 #include "Conn.h"
+#include "File.h"
 
 #include "event.bif.func_def"
diff --git a/src/File.cc b/src/File.cc
index 05c16d2efb..26ed28455b 100644
--- a/src/File.cc
+++ b/src/File.cc
@@ -328,8 +328,8 @@ void BroFile::RaiseOpenEvent()
 	if ( ! ::file_opened )
 		return;
 
-	Ref(this);
-	Event* event = new ::Event(::file_opened, {make_intrusive<Val>(this)});
+	IntrusivePtr<BroFile> bf{NewRef{}, this};
+	Event* event = new ::Event(::file_opened, {make_intrusive<Val>(std::move(bf))});
 	mgr.Dispatch(event, true);
 	}
 
diff --git a/src/Stats.cc b/src/Stats.cc
index 2b2c187c73..09c5df495c 100644
--- a/src/Stats.cc
+++ b/src/Stats.cc
@@ -311,9 +311,8 @@ void ProfileLogger::Log()
 	// (and for consistency we dispatch it *now*)
 	if ( profiling_update )
 		{
-		Ref(file);
 		mgr.Dispatch(new Event(profiling_update, {
-			make_intrusive<Val>(file),
+			make_intrusive<Val>(IntrusivePtr{NewRef{}, file}),
 			val_mgr->Bool(expensive),
 		}));
 		}
diff --git a/src/Val.cc b/src/Val.cc
index d1850c6e1a..53769963ca 100644
--- a/src/Val.cc
+++ b/src/Val.cc
@@ -57,10 +57,13 @@ static const IntrusivePtr<FileType>& GetStringFileType() noexcept
 	return string_file_type;
 	}
 
-Val::Val(BroFile* f)
-	: val(f), type(GetStringFileType())
+Val::Val(BroFile* f) : Val({AdoptRef{}, f})
+	{}
+
+Val::Val(IntrusivePtr<BroFile> f)
+	: val(f.release()), type(GetStringFileType())
 	{
-	assert(f->FType()->Tag() == TYPE_STRING);
+	assert(val.file_val->FType()->Tag() == TYPE_STRING);
 	}
 
 Val::~Val()
diff --git a/src/Val.h b/src/Val.h
index 81dfd3003f..1948440387 100644
--- a/src/Val.h
+++ b/src/Val.h
@@ -133,9 +133,11 @@ public:
 	explicit Val(Func* f);
 	explicit Val(IntrusivePtr<Func> f);
 
-	// Note, will unref 'f' when it's done, closing it unless
-	// class has ref'd it.
+	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr instead.")]]
 	explicit Val(BroFile* f);
+	// Note, the file will be closed after this Val is destructed if there's
+	// no other remaining references.
+	explicit Val(IntrusivePtr<BroFile> f);
 
 	// Extra arg to differentiate from protected version.
 	Val(IntrusivePtr<BroType> t, bool type_type)
diff --git a/src/analyzer/protocol/tcp/functions.bif b/src/analyzer/protocol/tcp/functions.bif
index a560301b8a..461f7a510e 100644
--- a/src/analyzer/protocol/tcp/functions.bif
+++ b/src/analyzer/protocol/tcp/functions.bif
@@ -121,12 +121,13 @@ function set_contents_file%(cid: conn_id, direction: count, f: file%): bool
 function get_contents_file%(cid: conn_id, direction: count%): file
 	%{
 	Connection* c = sessions->FindConnection(cid);
-	BroFile* f = c ? c->GetRootAnalyzer()->GetContentsFile(direction) : nullptr;
 
-	if ( f )
+	if ( c )
 		{
-		Ref(f);
-		return make_intrusive<Val>(f);
+		auto cf = c->GetRootAnalyzer()->GetContentsFile(direction);
+
+		if ( cf )
+			return make_intrusive<Val>(IntrusivePtr{NewRef{}, cf});
 		}
 
 	// Return some sort of error value.
@@ -135,5 +136,5 @@ function get_contents_file%(cid: conn_id, direction: count%): file
 	else
 		builtin_error("no contents file for given direction");
 
-	return make_intrusive<Val>(new BroFile(stderr, "-", "w"));
+	return make_intrusive<Val>(make_intrusive<BroFile>(stderr, "-", "w"));
 	%}
diff --git a/src/broker/Data.cc b/src/broker/Data.cc
index f6f958d6a6..b17dc0dabc 100644
--- a/src/broker/Data.cc
+++ b/src/broker/Data.cc
@@ -127,7 +127,7 @@ struct val_converter {
 			auto file = BroFile::GetFile(a.data());
 
 			if ( file )
-				return new Val(file);
+				return new Val({AdoptRef{}, file});
 
 			return nullptr;
 			}
diff --git a/src/zeek.bif b/src/zeek.bif
index f649eb2727..01d933dfcd 100644
--- a/src/zeek.bif
+++ b/src/zeek.bif
@@ -4398,9 +4398,9 @@ function open%(f: string%): file
 	const char* file = f->CheckString();
 
 	if ( streq(file, "-") )
-		return make_intrusive<Val>(new BroFile(stdout, "-", "w"));
+		return make_intrusive<Val>(make_intrusive<BroFile>(stdout, "-", "w"));
 	else
-		return make_intrusive<Val>(new BroFile(file, "w"));
+		return make_intrusive<Val>(make_intrusive<BroFile>(file, "w"));
 	%}
 
 ## Opens a file for writing or appending. If a file with the same name already
@@ -4415,7 +4415,7 @@ function open%(f: string%): file
 ##              rmdir unlink rename
 function open_for_append%(f: string%): file
 	%{
-	return make_intrusive<Val>(new BroFile(f->CheckString(), "a"));
+	return make_intrusive<Val>(make_intrusive<BroFile>(f->CheckString(), "a"));
 	%}
 
 ## Closes an open file and flushes any buffered content.