diff --git a/src/CompHash.cc b/src/CompHash.cc
index 2e0a6590e7..ed3b7788a0 100644
--- a/src/CompHash.cc
+++ b/src/CompHash.cc
@@ -845,7 +845,7 @@ const char* CompositeHash::RecoverOneVal(const HashKey* k, const char* kp0,
 			const uint32_t* const kp = AlignType<uint32_t>(kp0);
 			kp1 = reinterpret_cast<const char*>(kp+1);
 
-			Func* f = Func::GetFuncPtrByID(*kp);
+			const auto& f = Func::GetFuncPtrByID(*kp);
 
 			if ( ! f )
 				reporter->InternalError("failed to look up unique function id %" PRIu32 " in CompositeHash::RecoverOneVal()", *kp);
diff --git a/src/Expr.cc b/src/Expr.cc
index 7dfba4020f..739a0e8b8b 100644
--- a/src/Expr.cc
+++ b/src/Expr.cc
@@ -4207,7 +4207,7 @@ LambdaExpr::LambdaExpr(std::unique_ptr<function_ingredients> arg_ing,
 
 	// Install a dummy version of the function globally for use only
 	// when broker provides a closure.
-	BroFunc* dummy_func = new BroFunc(
+	auto dummy_func = make_intrusive<BroFunc>(
 		ingredients->id.get(),
 		ingredients->body,
 		shallow_copy_func_inits(ingredients->body, ingredients->inits).release(),
@@ -4245,8 +4245,7 @@ LambdaExpr::LambdaExpr(std::unique_ptr<function_ingredients> arg_ing,
 	// Update lamb's name
 	dummy_func->SetName(my_name.c_str());
 
-	auto v = make_intrusive<Val>(dummy_func);
-	Unref(dummy_func);
+	auto v = make_intrusive<Val>(std::move(dummy_func));
 	id->SetVal(std::move(v));
 	id->SetType(ingredients->id->GetType());
 	id->SetConst();
@@ -4272,7 +4271,7 @@ IntrusivePtr<Val> LambdaExpr::Eval(Frame* f) const
 	// Allows for lookups by the receiver.
 	lamb->SetName(my_name.c_str());
 
-	return make_intrusive<Val>(lamb.get());
+	return make_intrusive<Val>(std::move(lamb));
 	}
 
 void LambdaExpr::ExprDescribe(ODesc* d) const
diff --git a/src/Func.cc b/src/Func.cc
index a40b384a17..5d4da73ced 100644
--- a/src/Func.cc
+++ b/src/Func.cc
@@ -59,7 +59,6 @@ extern	RETSIGTYPE sig_handler(int signo);
 std::vector<CallInfo> call_stack;
 bool did_builtin_init = false;
 
-std::vector<Func*> Func::unique_ids;
 static const std::pair<bool, Val*> empty_hook_result(false, NULL);
 
 std::string render_call_stack()
@@ -111,13 +110,13 @@ std::string render_call_stack()
 Func::Func()
 	{
 	unique_id = unique_ids.size();
-	unique_ids.push_back(this);
+	unique_ids.push_back({NewRef{}, this});
 	}
 
 Func::Func(Kind arg_kind) : kind(arg_kind)
 	{
 	unique_id = unique_ids.size();
-	unique_ids.push_back(this);
+	unique_ids.push_back({NewRef{}, this});
 	}
 
 Func::~Func() = default;
@@ -594,7 +593,7 @@ BuiltinFunc::BuiltinFunc(built_in_func arg_func, const char* arg_name,
 		reporter->InternalError("built-in function %s multiply defined", Name());
 
 	type = id->GetType();
-	id->SetVal(make_intrusive<Val>(this));
+	id->SetVal(make_intrusive<Val>(IntrusivePtr{NewRef{}, this}));
 	}
 
 BuiltinFunc::~BuiltinFunc()
diff --git a/src/Func.h b/src/Func.h
index cc18471b1a..9eaedd5ac8 100644
--- a/src/Func.h
+++ b/src/Func.h
@@ -93,8 +93,11 @@ public:
 	virtual TraversalCode Traverse(TraversalCallback* cb) const;
 
 	uint32_t GetUniqueFuncID() const { return unique_id; }
-	static Func* GetFuncPtrByID(uint32_t id)
-		{ return id >= unique_ids.size() ? nullptr : unique_ids[id]; }
+	static const IntrusivePtr<Func>& GetFuncPtrByID(uint32_t id)
+		{
+		static IntrusivePtr<Func> nil;
+		return id >= unique_ids.size() ? nil : unique_ids[id];
+		}
 
 protected:
 	Func();
@@ -111,7 +114,7 @@ protected:
 	uint32_t unique_id;
 	IntrusivePtr<BroType> type;
 	std::string name;
-	static std::vector<Func*> unique_ids;
+	static inline std::vector<IntrusivePtr<Func>> unique_ids;
 };
 
 
diff --git a/src/Val.cc b/src/Val.cc
index 4e39ac676e..d1850c6e1a 100644
--- a/src/Val.cc
+++ b/src/Val.cc
@@ -42,11 +42,12 @@
 
 using namespace std;
 
-Val::Val(Func* f)
-	: val(f), type({NewRef{}, f->FType()})
-	{
-	::Ref(val.func_val);
-	}
+Val::Val(Func* f) : Val({NewRef{}, f})
+	{}
+
+Val::Val(IntrusivePtr<Func> f)
+	: val(f.release()), type({NewRef{}, val.func_val->FType()})
+	{}
 
 static const IntrusivePtr<FileType>& GetStringFileType() noexcept
 	{
@@ -118,7 +119,7 @@ IntrusivePtr<Val> Val::DoClone(CloneState* state)
 		// Derived classes are responsible for this. Exception:
 		// Functions and files. There aren't any derived classes.
 		if ( type->Tag() == TYPE_FUNC )
-			return make_intrusive<Val>(AsFunc()->DoClone().get());
+			return make_intrusive<Val>(AsFunc()->DoClone());
 
 		if ( type->Tag() == TYPE_FILE )
 			{
diff --git a/src/Val.h b/src/Val.h
index d94d94624c..81dfd3003f 100644
--- a/src/Val.h
+++ b/src/Val.h
@@ -129,7 +129,9 @@ public:
 		: val(d), type(base_type(t))
 		{}
 
+	[[deprecated("Remove in v4.1.  Construct from IntrusivePtr instead.")]]
 	explicit Val(Func* f);
+	explicit Val(IntrusivePtr<Func> f);
 
 	// Note, will unref 'f' when it's done, closing it unless
 	// class has ref'd it.
diff --git a/src/Var.cc b/src/Var.cc
index f89d1b1473..a5d64a65d5 100644
--- a/src/Var.cc
+++ b/src/Var.cc
@@ -298,8 +298,8 @@ static void make_var(ID* id, IntrusivePtr<BroType> t, init_class c,
 		// For events, add a function value (without any body) here so that
 		// we can later access the ID even if no implementations have been
 		// defined.
-		Func* f = new BroFunc(id, nullptr, nullptr, 0, 0);
-		id->SetVal(make_intrusive<Val>(f));
+		auto f = make_intrusive<BroFunc>(id, nullptr, nullptr, 0, 0);
+		id->SetVal(make_intrusive<Val>(std::move(f)));
 		}
 	}
 
@@ -638,14 +638,14 @@ void end_func(IntrusivePtr<Stmt> body)
 			ingredients->priority);
 	else
 		{
-		Func* f = new BroFunc(
+		auto f = make_intrusive<BroFunc>(
 			ingredients->id.get(),
 			ingredients->body,
 			ingredients->inits,
 			ingredients->frame_size,
 			ingredients->priority);
 
-		ingredients->id->SetVal(make_intrusive<Val>(f));
+		ingredients->id->SetVal(make_intrusive<Val>(std::move(f)));
 		ingredients->id->SetConst();
 		}