diff --git a/src/CompHash.cc b/src/CompHash.cc
index 4773e7aa33..17e4c0dfde 100644
--- a/src/CompHash.cc
+++ b/src/CompHash.cc
@@ -720,19 +720,19 @@ int CompositeHash::SizeAlign(int offset, unsigned int size) const
 	return offset;
 	}
 
-ListVal* CompositeHash::RecoverVals(const HashKey* k) const
+IntrusivePtr<ListVal> CompositeHash::RecoverVals(const HashKey* k) const
 	{
-	ListVal* l = new ListVal(TYPE_ANY);
+	auto l = make_intrusive<ListVal>(TYPE_ANY);
 	const type_list* tl = type->Types();
 	const char* kp = (const char*) k->Key();
 	const char* const k_end = kp + k->Size();
 
 	for ( const auto& type : *tl )
 		{
-		Val* v = nullptr;
+		IntrusivePtr<Val> v;
 		kp = RecoverOneVal(k, kp, k_end, type, v, false);
 		ASSERT(v);
-		l->Append(v);
+		l->Append(v.release());
 		}
 
 	if ( kp != k_end )
@@ -743,7 +743,7 @@ ListVal* CompositeHash::RecoverVals(const HashKey* k) const
 
 const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 					 const char* const k_end, BroType* t,
-					 Val*& pval, bool optional) const
+					 IntrusivePtr<Val>& pval, bool optional) const
 	{
 	// k->Size() == 0 for a single empty string.
 	if ( kp0 >= k_end && k->Size() > 0 )
@@ -772,11 +772,11 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 		kp1 = reinterpret_cast<const char*>(kp+1);
 
 		if ( tag == TYPE_ENUM )
-			pval = t->AsEnumType()->GetVal(*kp).release();
+			pval = t->AsEnumType()->GetVal(*kp);
 		else if ( tag == TYPE_BOOL )
-			pval = val_mgr->GetBool(*kp);
+			pval = {AdoptRef{}, val_mgr->GetBool(*kp)};
 		else if ( tag == TYPE_INT )
-			pval = val_mgr->GetInt(*kp);
+			pval = {AdoptRef{}, val_mgr->GetInt(*kp)};
 		else
 			{
 			reporter->InternalError("bad internal unsigned int in CompositeHash::RecoverOneVal()");
@@ -793,11 +793,11 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 		switch ( tag ) {
 		case TYPE_COUNT:
 		case TYPE_COUNTER:
-			pval = val_mgr->GetCount(*kp);
+			pval = {AdoptRef{}, val_mgr->GetCount(*kp)};
 			break;
 
 		case TYPE_PORT:
-			pval = val_mgr->GetPort(*kp);
+			pval = {AdoptRef{}, val_mgr->GetPort(*kp)};
 			break;
 
 		default:
@@ -814,9 +814,9 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 		kp1 = reinterpret_cast<const char*>(kp+1);
 
 		if ( tag == TYPE_INTERVAL )
-			pval = new IntervalVal(*kp, 1.0);
+			pval = make_intrusive<IntervalVal>(*kp, 1.0);
 		else
-			pval = new Val(*kp, tag);
+			pval = make_intrusive<Val>(*kp, tag);
 		}
 		break;
 
@@ -829,7 +829,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 
 		switch ( tag ) {
 		case TYPE_ADDR:
-			pval = new AddrVal(addr);
+			pval = make_intrusive<AddrVal>(addr);
 			break;
 
 		default:
@@ -844,7 +844,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 		{
 		const uint32_t* const kp = AlignType<uint32_t>(kp0);
 		kp1 = reinterpret_cast<const char*>(kp+5);
-		pval = new SubNetVal(kp, kp[4]);
+		pval = make_intrusive<SubNetVal>(kp, kp[4]);
 		}
 		break;
 
@@ -862,7 +862,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 			if ( ! f )
 				reporter->InternalError("failed to look up unique function id %" PRIu32 " in CompositeHash::RecoverOneVal()", *kp);
 
-			pval = new Val(f);
+			pval = make_intrusive<Val>(f);
 
 			if ( ! pval->Type() )
 				reporter->InternalError("bad aggregate Val in CompositeHash::RecoverOneVal()");
@@ -898,7 +898,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 				re = new RE_Matcher(kp1, kp1 + len[0]);
 				kp1 += len[0] + len[1];
 				}
-			pval = new PatternVal(re);
+			pval = make_intrusive<PatternVal>(re);
 			}
 			break;
 
@@ -912,7 +912,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 			int i;
 			for ( i = 0; i < num_fields; ++i )
 				{
-				Val* v;
+				IntrusivePtr<Val> v;
 
 				Attributes* a = rt->FieldDecl(i)->attrs;
 				bool optional = (a && a->FindAttr(ATTR_OPTIONAL));
@@ -930,17 +930,17 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 					break;
 					}
 
-				values.push_back(v);
+				values.push_back(v.release());
 				}
 
 			ASSERT(int(values.size()) == num_fields);
 
-			RecordVal* rv = new RecordVal(rt);
+			auto rv = make_intrusive<RecordVal>(rt);
 
 			for ( int i = 0; i < num_fields; ++i )
 				rv->Assign(i, values[i]);
 
-			pval = rv;
+			pval = std::move(rv);
 			kp1 = kp;
 			}
 			break;
@@ -952,19 +952,19 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 			n = *kp;
 			kp1 = reinterpret_cast<const char*>(kp+1);
 			TableType* tt = t->AsTableType();
-			TableVal* tv = new TableVal(tt);
+			auto tv = make_intrusive<TableVal>(tt);
 			vector<Val*> keys, values;
 			for ( int i = 0; i < n; ++i )
 				{
-				Val* key;
+				IntrusivePtr<Val> key;
 				kp1 = RecoverOneVal(k, kp1, k_end, tt->Indices(), key, false);
-				keys.push_back(key);
+				keys.push_back(key.release());
 				if ( ! t->IsSet() )
 					{
-					Val* value;
+					IntrusivePtr<Val> value;
 					kp1 = RecoverOneVal(k, kp1, k_end, tt->YieldType(), value,
 					                    false);
-					values.push_back(value);
+					values.push_back(value.release());
 					}
 				}
 
@@ -974,7 +974,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 				Unref(keys[i]);
 				}
 
-			pval = tv;
+			pval = std::move(tv);
 			}
 			break;
 
@@ -985,7 +985,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 			n = *kp;
 			kp1 = reinterpret_cast<const char*>(kp+1);
 			VectorType* vt = t->AsVectorType();
-			VectorVal* vv = new VectorVal(vt);
+			auto vv = make_intrusive<VectorVal>(vt);
 			for ( unsigned int i = 0; i < n; ++i )
 				{
 				kp = AlignType<unsigned int>(kp1);
@@ -994,14 +994,14 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 				kp = AlignType<unsigned int>(kp1);
 				unsigned int have_val = *kp;
 				kp1 = reinterpret_cast<const char*>(kp+1);
-				Val* value = 0;
+				IntrusivePtr<Val> value;
 				if ( have_val )
 					kp1 = RecoverOneVal(k, kp1, k_end, vt->YieldType(), value,
 					                    false);
-				vv->Assign(index, value);
+				vv->Assign(index, std::move(value));
 				}
 
-			pval = vv;
+			pval = std::move(vv);
 			}
 			break;
 
@@ -1012,16 +1012,16 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 			n = *kp;
 			kp1 = reinterpret_cast<const char*>(kp+1);
 			TypeList* tl = t->AsTypeList();
-			ListVal* lv = new ListVal(TYPE_ANY);
+			auto lv = make_intrusive<ListVal>(TYPE_ANY);
 			for ( int i = 0; i < n; ++i )
 				{
-				Val* v;
+				IntrusivePtr<Val> v;
 				BroType* it = (*tl->Types())[i];
 				kp1 = RecoverOneVal(k, kp1, k_end, it, v, false);
-				lv->Append(v);
+				lv->Append(v.release());
 				}
 
-			pval = lv;
+			pval = std::move(lv);
 			}
 			break;
 
@@ -1051,7 +1051,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 			kp1 = reinterpret_cast<const char*>(kp+1);
 			}
 
-		pval = new StringVal(new BroString((const byte_vec) kp1, n, 1));
+		pval = make_intrusive<StringVal>(new BroString((const byte_vec) kp1, n, 1));
 		kp1 += n;
 		}
 		break;
diff --git a/src/CompHash.h b/src/CompHash.h
index 9aa3555200..95bca07571 100644
--- a/src/CompHash.h
+++ b/src/CompHash.h
@@ -18,7 +18,7 @@ public:
 	HashKey* ComputeHash(const Val* v, int type_check) const;
 
 	// Given a hash key, recover the values used to create it.
-	ListVal* RecoverVals(const HashKey* k) const;
+	IntrusivePtr<ListVal> RecoverVals(const HashKey* k) const;
 
 	unsigned int MemoryAllocation() const { return padded_sizeof(*this) + pad_size(size); }
 
@@ -36,7 +36,7 @@ protected:
 	// upon errors, so there is no return value for invalid input.
 	const char* RecoverOneVal(const HashKey* k,
 				  const char* kp, const char* const k_end,
-				  BroType* t, Val*& pval, bool optional) const;
+				  BroType* t, IntrusivePtr<Val>& pval, bool optional) const;
 
 	// Rounds the given pointer up to the nearest multiple of the
 	// given size, if not already a multiple.
diff --git a/src/Val.cc b/src/Val.cc
index b69025e61b..e6bfc6a8dd 100644
--- a/src/Val.cc
+++ b/src/Val.cc
@@ -1568,10 +1568,9 @@ int TableVal::AddTo(Val* val, int is_first_init, bool propagate_ops) const
 		{
 		if ( is_first_init && t->AsTable()->Lookup(k) )
 			{
-			Val* key = table_hash->RecoverVals(k);
+			auto key = table_hash->RecoverVals(k);
 			// ### Shouldn't complain if their values are equal.
 			key->Warn("multiple initializations for index");
-			Unref(key);
 			continue;
 			}
 
@@ -1959,7 +1958,7 @@ bool TableVal::UpdateTimestamp(Val* index)
 
 ListVal* TableVal::RecoverIndex(const HashKey* k) const
 	{
-	return table_hash->RecoverVals(k);
+	return table_hash->RecoverVals(k).release();
 	}
 
 void TableVal::CallChangeFunc(const Val* index, Val* old_value, OnChangeType tpe)
@@ -2047,10 +2046,9 @@ Val* TableVal::Delete(const HashKey* k)
 
 	if ( subnets )
 		{
-		Val* index = table_hash->RecoverVals(k);
-		if ( ! subnets->Remove(index) )
+		auto index = table_hash->RecoverVals(k);
+		if ( ! subnets->Remove(index.get()) )
 			reporter->InternalWarning("index not in prefix table");
-		Unref(index);
 		}
 
 	delete v;
@@ -2060,8 +2058,7 @@ Val* TableVal::Delete(const HashKey* k)
 	if ( change_func && va )
 		{
 		auto index = table_hash->RecoverVals(k);
-		CallChangeFunc(index, va->Ref(), ELEMENT_REMOVED);
-		Unref(index);
+		CallChangeFunc(index.get(), va->Ref(), ELEMENT_REMOVED);
 		}
 
 	return va;
@@ -2077,19 +2074,17 @@ ListVal* TableVal::ConvertToList(TypeTag t) const
 	HashKey* k;
 	while ( tbl->NextEntry(k, c) )
 		{
-		ListVal* index = table_hash->RecoverVals(k);
+		auto index = table_hash->RecoverVals(k);
 
 		if ( t == TYPE_ANY )
-			l->Append(index);
+			l->Append(index.release());
 		else
 			{
 			// We're expecting a pure list, flatten the
 			// ListVal.
 			if ( index->Length() != 1 )
 				InternalWarning("bad index in TableVal::ConvertToList");
-			Val* flat_v = index->Index(0)->Ref();
-			Unref(index);
-			l->Append(flat_v);
+			l->Append(index->Index(0)->Ref());
 			}
 
 		delete k;
@@ -2144,7 +2139,7 @@ void TableVal::Describe(ODesc* d) const
 		if ( ! v )
 			reporter->InternalError("hash table underflow in TableVal::Describe");
 
-		ListVal* vl = table_hash->RecoverVals(k);
+		auto vl = table_hash->RecoverVals(k);
 		int dim = vl->Length();
 
 		if ( i > 0 )
@@ -2169,7 +2164,6 @@ void TableVal::Describe(ODesc* d) const
 		vl->Describe(d);
 
 		delete k;
-		Unref(vl);
 
 		if ( table_type->IsSet() )
 			{ // We're a set, not a table.