diff --git a/src/Debug.cc b/src/Debug.cc
index d42cb9f71e..264a06e00b 100644
--- a/src/Debug.cc
+++ b/src/Debug.cc
@@ -234,7 +234,7 @@ static void parse_function_name(vector<ParseLocationRec>& result,
 	Stmt* body = 0;	// the particular body we care about; 0 = all
 
 	if ( bodies.size() == 1 )
-		body = bodies[0].stmts;
+		body = bodies[0].stmts.get();
 	else
 		{
 		while ( 1 )
@@ -245,7 +245,7 @@ static void parse_function_name(vector<ParseLocationRec>& result,
 				{
 				Stmt* first;
 				Location stmt_loc;
-				get_first_statement(bodies[i].stmts, first,
+				get_first_statement(bodies[i].stmts.get(), first,
 							stmt_loc);
 				debug_msg("[%d] %s:%d\n", i+1, stmt_loc.filename, stmt_loc.first_line);
 				}
@@ -278,7 +278,7 @@ static void parse_function_name(vector<ParseLocationRec>& result,
 			int option = atoi(input.c_str());
 			if ( option > 0 && option <= (int) bodies.size() )
 				{
-				body = bodies[option - 1].stmts;
+				body = bodies[option - 1].stmts.get();
 				break;
 				}
 			}
@@ -308,7 +308,7 @@ static void parse_function_name(vector<ParseLocationRec>& result,
 
 		for ( unsigned int i = 0; i < bodies.size(); ++i )
 			{
-			get_first_statement(bodies[i].stmts, first, stmt_loc);
+			get_first_statement(bodies[i].stmts.get(), first, stmt_loc);
 			if ( ! first )
 				continue;
 
diff --git a/src/EventHandler.cc b/src/EventHandler.cc
index dc62971305..a0278f8278 100644
--- a/src/EventHandler.cc
+++ b/src/EventHandler.cc
@@ -114,7 +114,7 @@ void EventHandler::Call(val_list* vl, bool no_remote)
 
 	if ( local )
 		// No try/catch here; we pass exceptions upstream.
-		Unref(local->Call(vl));
+		local->Call(vl);
 	else
 		{
 		for ( auto v : *vl )
diff --git a/src/Expr.cc b/src/Expr.cc
index d4b000723b..079d5f50fc 100644
--- a/src/Expr.cc
+++ b/src/Expr.cc
@@ -4241,7 +4241,7 @@ IntrusivePtr<Val> CallExpr::Eval(Frame* f) const
 		if ( f )
 			f->SetCall(this);
 
-		ret = {AdoptRef{}, func->Call(v, f)};
+		ret = func->Call(v, f);
 
 		if ( f )
 			f->SetCall(current_call);
@@ -4307,9 +4307,8 @@ LambdaExpr::LambdaExpr(std::unique_ptr<function_ingredients> arg_ing,
 
 	// Install a dummy version of the function globally for use only
 	// when broker provides a closure.
-	::Ref(ingredients->body);
 	BroFunc* dummy_func = new BroFunc(
-		ingredients->id,
+		ingredients->id.get(),
 		ingredients->body,
 		ingredients->body && ingredients->inits && ingredients->inits->length() > 0 ? shallow_copy_id_list(*ingredients->inits).release() : nullptr,
 		ingredients->frame_size,
@@ -4355,9 +4354,8 @@ LambdaExpr::LambdaExpr(std::unique_ptr<function_ingredients> arg_ing,
 
 IntrusivePtr<Val> LambdaExpr::Eval(Frame* f) const
 	{
-	::Ref(ingredients->body);
 	auto lamb = make_intrusive<BroFunc>(
-		ingredients->id,
+		ingredients->id.get(),
 		ingredients->body,
 		ingredients->body && ingredients->inits && ingredients->inits->length() > 0 ? shallow_copy_id_list(*ingredients->inits).release() : nullptr,
 		ingredients->frame_size,
diff --git a/src/Func.cc b/src/Func.cc
index e6924a539f..6e94debd6a 100644
--- a/src/Func.cc
+++ b/src/Func.cc
@@ -111,35 +111,36 @@ std::string render_call_stack()
 	return rval;
 	}
 
-Func::Func() : scope(0), type(0)
+Func::Func()
 	{
 	unique_id = unique_ids.size();
 	unique_ids.push_back(this);
 	}
 
-Func::Func(Kind arg_kind) : scope(0), kind(arg_kind), type(0)
+Func::Func(Kind arg_kind) : kind(arg_kind)
 	{
 	unique_id = unique_ids.size();
 	unique_ids.push_back(this);
 	}
 
-Func::~Func()
-	{
-	Unref(type);
-	}
+Func::~Func() = default;
 
-void Func::AddBody(Stmt* /* new_body */, id_list* /* new_inits */,
+void Func::AddBody(IntrusivePtr<Stmt> /* new_body */, id_list* /* new_inits */,
 		   size_t /* new_frame_size */, int /* priority */)
 	{
 	Internal("Func::AddBody called");
 	}
 
-Func* Func::DoClone()
+void Func::SetScope(IntrusivePtr<Scope> newscope)
+	{
+	scope = std::move(newscope);
+	}
+
+IntrusivePtr<Func> Func::DoClone()
 	{
 	// By default, ok just to return a reference. Func does not have any state
 	// that is different across instances.
-	::Ref(this);
-	return this;
+	return {NewRef{}, this};
 	}
 
 void Func::DescribeDebug(ODesc* d, const val_list* args) const
@@ -180,7 +181,7 @@ TraversalCode Func::Traverse(TraversalCallback* cb) const
 	{
 	// FIXME: Make a fake scope for builtins?
 	Scope* old_scope = cb->current_scope;
-	cb->current_scope = scope;
+	cb->current_scope = scope.get();
 
 	TraversalCode tc = cb->PreFunction(this);
 	HANDLE_TC_STMT_PRE(tc);
@@ -206,13 +207,10 @@ TraversalCode Func::Traverse(TraversalCallback* cb) const
 
 void Func::CopyStateInto(Func* other) const
 	{
-	std::for_each(bodies.begin(), bodies.end(), [](const Body& b) { Ref(b.stmts); });
-
 	other->bodies = bodies;
 	other->scope = scope;
 	other->kind = kind;
 
-	Ref(type);
 	other->type = type;
 
 	other->name = name;
@@ -273,17 +271,17 @@ std::pair<bool, Val*> Func::HandlePluginResult(std::pair<bool, Val*> plugin_resu
 	return plugin_result;
 	}
 
-BroFunc::BroFunc(ID* arg_id, Stmt* arg_body, id_list* aggr_inits,
+BroFunc::BroFunc(ID* arg_id, IntrusivePtr<Stmt> arg_body, id_list* aggr_inits,
 		 size_t arg_frame_size, int priority) : Func(BRO_FUNC)
 	{
 	name = arg_id->Name();
-	type = arg_id->Type()->Ref();
+	type = {NewRef{}, arg_id->Type()};
 	frame_size = arg_frame_size;
 
 	if ( arg_body )
 		{
 		Body b;
-		b.stmts = AddInits(arg_body, aggr_inits);
+		b.stmts = AddInits(std::move(arg_body), aggr_inits);
 		b.priority = priority;
 		bodies.push_back(b);
 		}
@@ -291,9 +289,6 @@ BroFunc::BroFunc(ID* arg_id, Stmt* arg_body, id_list* aggr_inits,
 
 BroFunc::~BroFunc()
 	{
-	std::for_each(bodies.begin(), bodies.end(),
-		[](Body& b) { Unref(b.stmts); });
-
 	if ( ! weak_closure_ref )
 		Unref(closure);
 	}
@@ -304,7 +299,7 @@ int BroFunc::IsPure() const
 		[](const Body& b) { return b.stmts->IsPure(); });
 	}
 
-Val* BroFunc::Call(val_list* args, Frame* parent) const
+IntrusivePtr<Val> BroFunc::Call(val_list* args, Frame* parent) const
 	{
 #ifdef PROFILE_BRO_FUNCTIONS
 	DEBUG_MSG("Function: %s\n", Name());
@@ -321,7 +316,7 @@ Val* BroFunc::Call(val_list* args, Frame* parent) const
 	if( plugin_result.first )
 		{
 		Val *result = plugin_result.second;
-		return result;
+		return {AdoptRef{}, result};
 		}
 
 	if ( bodies.empty() )
@@ -331,10 +326,10 @@ Val* BroFunc::Call(val_list* args, Frame* parent) const
 		for ( const auto& arg : *args )
 			Unref(arg);
 
-		return Flavor() == FUNC_FLAVOR_HOOK ? val_mgr->GetTrue() : 0;
+		return Flavor() == FUNC_FLAVOR_HOOK ? IntrusivePtr{AdoptRef{}, val_mgr->GetTrue()} : nullptr;
 		}
 
-	Frame* f = new Frame(frame_size, this, args);
+	auto f = make_intrusive<Frame>(frame_size, this, args);
 
 	if ( closure )
 		f->CaptureClosure(closure, outer_ids);
@@ -346,7 +341,7 @@ Val* BroFunc::Call(val_list* args, Frame* parent) const
 		f->SetCall(parent->GetCall());
 		}
 
-	g_frame_stack.push_back(f);	// used for backtracing
+	g_frame_stack.push_back(f.get());	// used for backtracing
 	const CallExpr* call_expr = parent ? parent->GetCall() : nullptr;
 	call_stack.emplace_back(CallInfo{call_expr, this, args});
 
@@ -360,7 +355,7 @@ Val* BroFunc::Call(val_list* args, Frame* parent) const
 		}
 
 	stmt_flow_type flow = FLOW_NEXT;
-	Val* result = 0;
+	IntrusivePtr<Val> result;
 
 	for ( const auto& body : bodies )
 		{
@@ -368,8 +363,6 @@ Val* BroFunc::Call(val_list* args, Frame* parent) const
 			sample_logger->LocationSeen(
 				body.stmts->GetLocationInfo());
 
-		Unref(result);
-
 		// Fill in the rest of the frame with the function's arguments.
 		loop_over_list(*args, j)
 			{
@@ -387,7 +380,7 @@ Val* BroFunc::Call(val_list* args, Frame* parent) const
 
 		try
 			{
-			result = body.stmts->Exec(f, flow).release();
+			result = body.stmts->Exec(f.get(), flow);
 			}
 
 		catch ( InterpreterException& e )
@@ -397,7 +390,6 @@ Val* BroFunc::Call(val_list* args, Frame* parent) const
 				{
 				g_frame_stack.pop_back();
 				call_stack.pop_back();
-				Unref(f);
 				// Result not set b/c exception was thrown
 				throw;
 				}
@@ -418,13 +410,12 @@ Val* BroFunc::Call(val_list* args, Frame* parent) const
 			{
 			// Ignore any return values of hook bodies, final return value
 			// depends on whether a body returns as a result of break statement.
-			Unref(result);
-			result = 0;
+			result = nullptr;
 
 			if ( flow == FLOW_BREAK )
 				{
 				// Short-circuit execution of remaining hook handler bodies.
-				result = val_mgr->GetFalse();
+				result = {AdoptRef{}, val_mgr->GetFalse()};
 				break;
 				}
 			}
@@ -440,7 +431,7 @@ Val* BroFunc::Call(val_list* args, Frame* parent) const
 	if ( Flavor() == FUNC_FLAVOR_HOOK )
 		{
 		if ( ! result )
-			result = val_mgr->GetTrue();
+			result = {AdoptRef{}, val_mgr->GetTrue()};
 		}
 
 	// Warn if the function returns something, but we returned from
@@ -462,25 +453,21 @@ Val* BroFunc::Call(val_list* args, Frame* parent) const
 
 	g_frame_stack.pop_back();
 
-	Unref(f);
-
 	return result;
 	}
 
-void BroFunc::AddBody(Stmt* new_body, id_list* new_inits,
+void BroFunc::AddBody(IntrusivePtr<Stmt> new_body, id_list* new_inits,
 		      size_t new_frame_size, int priority)
 	{
 	if ( new_frame_size > frame_size )
 		frame_size = new_frame_size;
 
-	new_body = AddInits(new_body, new_inits);
+	new_body = AddInits(std::move(new_body), new_inits);
 
 	if ( Flavor() == FUNC_FLAVOR_FUNCTION )
 		{
 		// For functions, we replace the old body with the new one.
 		assert(bodies.size() <= 1);
-		for ( const auto& body : bodies )
-			Unref(body.stmts);
 		bodies.clear();
 		}
 
@@ -552,13 +539,13 @@ bool BroFunc::UpdateClosure(const broker::vector& data)
 	}
 
 
-Func* BroFunc::DoClone()
+IntrusivePtr<Func> BroFunc::DoClone()
 	{
 	// BroFunc could hold a closure. In this case a clone of it must
 	// store a copy of this closure.
-	BroFunc* other = new BroFunc();
+	auto other = IntrusivePtr{AdoptRef{}, new BroFunc()};
 
-	CopyStateInto(other);
+	CopyStateInto(other.get());
 
 	other->frame_size = frame_size;
 	other->closure = closure ? closure->SelectiveClone(outer_ids, this) : nullptr;
@@ -586,14 +573,14 @@ void BroFunc::Describe(ODesc* d) const
 		}
 	}
 
-Stmt* BroFunc::AddInits(Stmt* body, id_list* inits)
+IntrusivePtr<Stmt> BroFunc::AddInits(IntrusivePtr<Stmt> body, id_list* inits)
 	{
 	if ( ! inits || inits->length() == 0 )
 		return body;
 
-	StmtList* stmt_series = new StmtList;
+	auto stmt_series = make_intrusive<StmtList>();
 	stmt_series->Stmts().push_back(new InitStmt(inits));
-	stmt_series->Stmts().push_back(body);
+	stmt_series->Stmts().push_back(body.release());
 
 	return stmt_series;
 	}
@@ -612,7 +599,7 @@ BuiltinFunc::BuiltinFunc(built_in_func arg_func, const char* arg_name,
 	if ( id->HasVal() )
 		reporter->InternalError("built-in function %s multiply defined", Name());
 
-	type = id->Type()->Ref();
+	type = {NewRef{}, id->Type()};
 	id->SetVal(make_intrusive<Val>(this));
 	}
 
@@ -625,7 +612,7 @@ int BuiltinFunc::IsPure() const
 	return is_pure;
 	}
 
-Val* BuiltinFunc::Call(val_list* args, Frame* parent) const
+IntrusivePtr<Val> BuiltinFunc::Call(val_list* args, Frame* parent) const
 	{
 #ifdef PROFILE_BRO_FUNCTIONS
 	DEBUG_MSG("Function: %s\n", Name());
@@ -642,7 +629,7 @@ Val* BuiltinFunc::Call(val_list* args, Frame* parent) const
 	if ( plugin_result.first )
 		{
 		Val *result = plugin_result.second;
-		return result;
+		return {AdoptRef{}, result};
 		}
 
 	if ( g_trace_state.DoTrace() )
@@ -655,7 +642,7 @@ Val* BuiltinFunc::Call(val_list* args, Frame* parent) const
 
 	const CallExpr* call_expr = parent ? parent->GetCall() : nullptr;
 	call_stack.emplace_back(CallInfo{call_expr, this, args});
-	Val* result = func(parent, args);
+	IntrusivePtr<Val> result{AdoptRef{}, func(parent, args)};
 	call_stack.pop_back();
 
 	for ( const auto& arg : *args )
@@ -885,29 +872,22 @@ static int get_func_priority(const attr_list& attrs)
 	return priority;
 	}
 
-function_ingredients::function_ingredients(Scope* scope, Stmt* body)
+function_ingredients::function_ingredients(IntrusivePtr<Scope> scope, IntrusivePtr<Stmt> body)
 	{
 	frame_size = scope->Length();
 	inits = scope->GetInits();
 
-	this->scope = scope;
-	::Ref(this->scope);
-	id = scope->ScopeID();
-	::Ref(id);
+	this->scope = std::move(scope);
+	id = {NewRef{}, this->scope->ScopeID()};
 
-	auto attrs = scope->Attrs();
+	auto attrs = this->scope->Attrs();
 
 	priority = (attrs ? get_func_priority(*attrs) : 0);
-	this->body = body;
-	::Ref(this->body);
+	this->body = std::move(body);
 	}
 
 function_ingredients::~function_ingredients()
 	{
-	Unref(id);
-	Unref(body);
-	Unref(scope);
-
 	for ( const auto& i : *inits )
 		Unref(i);
 
diff --git a/src/Func.h b/src/Func.h
index e70980d1de..74ad7920a9 100644
--- a/src/Func.h
+++ b/src/Func.h
@@ -4,6 +4,7 @@
 
 #include "BroList.h"
 #include "Obj.h"
+#include "IntrusivePtr.h"
 #include "Type.h" /* for function_flavor */
 #include "TraverseTypes.h"
 
@@ -40,7 +41,7 @@ public:
 	function_flavor Flavor() const	{ return FType()->Flavor(); }
 
 	struct Body {
-		Stmt* stmts;
+		IntrusivePtr<Stmt> stmts;
 		int priority;
 		bool operator<(const Body& other) const
 			{ return priority > other.priority; } // reverse sort
@@ -50,14 +51,14 @@ public:
 	bool HasBodies() const	{ return bodies.size(); }
 
 	// virtual Val* Call(ListExpr* args) const = 0;
-	virtual Val* Call(val_list* args, Frame* parent = 0) const = 0;
+	virtual IntrusivePtr<Val> Call(val_list* args, Frame* parent = 0) const = 0;
 
 	// Add a new event handler to an existing function (event).
-	virtual void AddBody(Stmt* new_body, id_list* new_inits,
+	virtual void AddBody(IntrusivePtr<Stmt> new_body, id_list* new_inits,
 			     size_t new_frame_size, int priority = 0);
 
-	virtual void SetScope(Scope* newscope)	{ scope = newscope; }
-	virtual Scope* GetScope() const		{ return scope; }
+	virtual void SetScope(IntrusivePtr<Scope> newscope);
+	virtual Scope* GetScope() const		{ return scope.get(); }
 
 	virtual FuncType* FType() const { return type->AsFuncType(); }
 
@@ -69,7 +70,7 @@ public:
 	void Describe(ODesc* d) const override = 0;
 	virtual void DescribeDebug(ODesc* d, const val_list* args) const;
 
-	virtual Func* DoClone();
+	virtual IntrusivePtr<Func> DoClone();
 
 	virtual TraversalCode Traverse(TraversalCallback* cb) const;
 
@@ -87,9 +88,9 @@ protected:
 	std::pair<bool, Val*> HandlePluginResult(std::pair<bool, Val*> plugin_result, val_list* args, function_flavor flavor) const;
 
 	vector<Body> bodies;
-	Scope* scope;
+	IntrusivePtr<Scope> scope;
 	Kind kind;
-	BroType* type;
+	IntrusivePtr<BroType> type;
 	string name;
 	uint32_t unique_id;
 	static vector<Func*> unique_ids;
@@ -98,11 +99,11 @@ protected:
 
 class BroFunc : public Func {
 public:
-	BroFunc(ID* id, Stmt* body, id_list* inits, size_t frame_size, int priority);
+	BroFunc(ID* id, IntrusivePtr<Stmt> body, id_list* inits, size_t frame_size, int priority);
 	~BroFunc() override;
 
 	int IsPure() const override;
-	Val* Call(val_list* args, Frame* parent) const override;
+	IntrusivePtr<Val> Call(val_list* args, Frame* parent) const override;
 
 	/**
 	 * Adds adds a closure to the function. Closures are cloned and
@@ -133,7 +134,7 @@ public:
 	 */
 	broker::expected<broker::data> SerializeClosure() const;
 
-	void AddBody(Stmt* new_body, id_list* new_inits,
+	void AddBody(IntrusivePtr<Stmt> new_body, id_list* new_inits,
 		     size_t new_frame_size, int priority) override;
 
 	/** Sets this function's outer_id list. */
@@ -144,12 +145,12 @@ public:
 
 protected:
 	BroFunc() : Func(BRO_FUNC)	{}
-	Stmt* AddInits(Stmt* body, id_list* inits);
+	IntrusivePtr<Stmt> AddInits(IntrusivePtr<Stmt> body, id_list* inits);
 
 	/**
 	 * Clones this function along with its closures.
 	 */
-	Func* DoClone() override;
+	IntrusivePtr<Func> DoClone() override;
 
 	/**
 	 * Performs a selective clone of *f* using the IDs that were
@@ -177,7 +178,7 @@ public:
 	~BuiltinFunc() override;
 
 	int IsPure() const override;
-	Val* Call(val_list* args, Frame* parent) const override;
+	IntrusivePtr<Val> Call(val_list* args, Frame* parent) const override;
 	built_in_func TheFunc() const	{ return func; }
 
 	void Describe(ODesc* d) const override;
@@ -208,16 +209,16 @@ struct function_ingredients {
 
 	// Gathers all of the information from a scope and a function body needed
 	// to build a function.
-	function_ingredients(Scope* scope, Stmt* body);
+	function_ingredients(IntrusivePtr<Scope> scope, IntrusivePtr<Stmt> body);
 
 	~function_ingredients();
 
-	ID* id;
-	Stmt* body;
+	IntrusivePtr<ID> id;
+	IntrusivePtr<Stmt> body;
 	id_list* inits;
 	int frame_size;
 	int priority;
-	Scope* scope;
+	IntrusivePtr<Scope> scope;
 };
 
 extern vector<CallInfo> call_stack;
diff --git a/src/RuleCondition.cc b/src/RuleCondition.cc
index ff42b135b9..e52861295a 100644
--- a/src/RuleCondition.cc
+++ b/src/RuleCondition.cc
@@ -179,15 +179,9 @@ bool RuleConditionEval::DoMatch(Rule* rule, RuleEndpointState* state,
 
 	try
 		{
-		Val* val = id->ID_Val()->AsFunc()->Call(&args);
+		auto val = id->ID_Val()->AsFunc()->Call(&args);
 
-		if ( val )
-			{
-			result = val->AsBool();
-			Unref(val);
-			}
-		else
-			result = false;
+		result = val && val->AsBool();
 		}
 
 	catch ( InterpreterException& e )
diff --git a/src/Val.cc b/src/Val.cc
index 4185e122e5..36a2de5cd6 100644
--- a/src/Val.cc
+++ b/src/Val.cc
@@ -111,12 +111,7 @@ Val* Val::DoClone(CloneState* state)
 		// Derived classes are responsible for this. Exception:
 		// Functions and files. There aren't any derived classes.
 		if ( type->Tag() == TYPE_FUNC )
-			{
-			auto c = AsFunc()->DoClone();
-			auto rval = new Val(c);
-			Unref(c);
-			return rval;
-			}
+			return new Val(AsFunc()->DoClone().get());
 
 		if ( type->Tag() == TYPE_FILE )
 			{
@@ -1793,7 +1788,7 @@ Val* TableVal::Default(Val* index)
 		vl = val_list{index->Ref()};
 		}
 
-	Val* result = 0;
+	IntrusivePtr<Val> result;
 
 	try
 		{
@@ -1809,7 +1804,7 @@ Val* TableVal::Default(Val* index)
 		return 0;
 		}
 
-	return result;
+	return result.release();
 	}
 
 Val* TableVal::Lookup(Val* index, bool use_default_val)
@@ -2456,14 +2451,11 @@ double TableVal::CallExpireFunc(Val* idx)
 		else
 			vl.append(idx);
 
-		Val* result = 0;
-
-		result = f->Call(&vl);
+		auto result = f->Call(&vl);
 
 		if ( result )
 			{
 			secs = result->AsInterval();
-			Unref(result);
 			}
 		}
 
diff --git a/src/Var.cc b/src/Var.cc
index b520c1e498..a9149af909 100644
--- a/src/Var.cc
+++ b/src/Var.cc
@@ -473,12 +473,11 @@ TraversalCode OuterIDBindingFinder::PostExpr(const Expr* expr)
 
 void end_func(IntrusivePtr<Stmt> body)
 	{
-	auto ingredients = std::make_unique<function_ingredients>(
-	        pop_scope().release(), body.release());
+	auto ingredients = std::make_unique<function_ingredients>(pop_scope(), std::move(body));
 
 	if ( streq(ingredients->id->Name(), "anonymous-function") )
 		{
-		OuterIDBindingFinder cb(ingredients->scope);
+		OuterIDBindingFinder cb(ingredients->scope.get());
 		ingredients->body->Traverse(&cb);
 
 		for ( size_t i = 0; i < cb.outer_id_references.size(); ++i )
@@ -495,7 +494,7 @@ void end_func(IntrusivePtr<Stmt> body)
 	else
 		{
 		Func* f = new BroFunc(
-			ingredients->id,
+			ingredients->id.get(),
 			ingredients->body,
 			ingredients->inits,
 			ingredients->frame_size,
diff --git a/src/broker/Manager.cc b/src/broker/Manager.cc
index 0a24a5ebc4..56e5d517fe 100644
--- a/src/broker/Manager.cc
+++ b/src/broker/Manager.cc
@@ -550,7 +550,7 @@ bool Manager::PublishLogWrite(EnumVal* stream, EnumVal* writer, string path, int
 		new StringVal(path),
 	};
 
-	Val* v = log_topic_func->Call(&vl);
+	auto v = log_topic_func->Call(&vl);
 
 	if ( ! v )
 		{
@@ -561,7 +561,6 @@ bool Manager::PublishLogWrite(EnumVal* stream, EnumVal* writer, string path, int
 		}
 
 	std::string topic = v->AsString()->CheckString();
-	Unref(v);
 
 	auto bstream_id = broker::enum_value(move(stream_id));
 	auto bwriter_id = broker::enum_value(move(writer_id));
diff --git a/src/broker/messaging.bif b/src/broker/messaging.bif
index 1bc950d2cc..ac5a7f878a 100644
--- a/src/broker/messaging.bif
+++ b/src/broker/messaging.bif
@@ -188,7 +188,6 @@ function Cluster::publish_rr%(pool: Pool, key: string, ...%): bool
 
 	if ( ! topic->AsString()->Len() )
 		{
-		Unref(topic);
 		return val_mgr->GetFalse();
 		}
 
@@ -199,7 +198,6 @@ function Cluster::publish_rr%(pool: Pool, key: string, ...%): bool
 		args.push_back((*bif_args)[i]);
 
 	auto rval = publish_event_args(args, topic->AsString(), frame);
-	Unref(topic);
 	return val_mgr->GetBool(rval);
 	%}
 
@@ -228,10 +226,7 @@ function Cluster::publish_hrw%(pool: Pool, key: any, ...%): bool
 	auto topic = topic_func->Call(&vl);
 
 	if ( ! topic->AsString()->Len() )
-		{
-		Unref(topic);
 		return val_mgr->GetFalse();
-		}
 
 	val_list* bif_args = @ARGS@;
 	val_list args(bif_args->length() - 2);
@@ -240,6 +235,5 @@ function Cluster::publish_hrw%(pool: Pool, key: any, ...%): bool
 		args.push_back((*bif_args)[i]);
 
 	auto rval = publish_event_args(args, topic->AsString(), frame);
-	Unref(topic);
 	return val_mgr->GetBool(rval);
 	%}
diff --git a/src/input/Manager.cc b/src/input/Manager.cc
index bd1036a35b..5d156dcf5d 100644
--- a/src/input/Manager.cc
+++ b/src/input/Manager.cc
@@ -1844,12 +1844,9 @@ bool Manager::CallPred(Func* pred_func, const int numvals, ...) const
 
 	va_end(lP);
 
-	Val* v = pred_func->Call(&vl);
+	auto v = pred_func->Call(&vl);
 	if ( v )
-		{
 		result = v->AsBool();
-		Unref(v);
-		}
 
 	return result;
 	}
diff --git a/src/logging/Manager.cc b/src/logging/Manager.cc
index d89d86d755..e1cfba3f11 100644
--- a/src/logging/Manager.cc
+++ b/src/logging/Manager.cc
@@ -739,12 +739,9 @@ bool Manager::Write(EnumVal* id, RecordVal* columns)
 
 			int result = 1;
 
-			Val* v = filter->pred->Call(&vl);
+			auto v = filter->pred->Call(&vl);
 			if ( v )
-				{
 				result = v->AsBool();
-				Unref(v);
-				}
 
 			if ( ! result )
 				continue;
@@ -773,9 +770,7 @@ bool Manager::Write(EnumVal* id, RecordVal* columns)
 				rec_arg,
 			};
 
-			Val* v = 0;
-
-			v = filter->path_func->Call(&vl);
+			auto v = filter->path_func->Call(&vl);
 
 			if ( ! v )
 				return false;
@@ -783,7 +778,6 @@ bool Manager::Write(EnumVal* id, RecordVal* columns)
 			if ( v->Type()->Tag() != TYPE_STRING )
 				{
 				reporter->Error("path_func did not return string");
-				Unref(v);
 				return false;
 				}
 
@@ -794,7 +788,6 @@ bool Manager::Write(EnumVal* id, RecordVal* columns)
 				}
 
 			path = v->AsString()->CheckString();
-			Unref(v);
 
 #ifdef DEBUG
 			DBG_LOG(DBG_LOGGING, "Path function for filter '%s' on stream '%s' return '%s'",
@@ -1090,9 +1083,9 @@ threading::Value** Manager::RecordToFilterVals(Stream* stream, Filter* filter,
 	if ( filter->num_ext_fields > 0 )
 		{
 		val_list vl{filter->path_val->Ref()};
-		Val* res = filter->ext_func->Call(&vl);
+		auto res = filter->ext_func->Call(&vl);
 		if ( res )
-			ext_rec = res->AsRecordVal();
+			ext_rec = res.release()->AsRecordVal();
 		}
 
 	threading::Value** vals = new threading::Value*[filter->num_fields];
@@ -1572,12 +1565,9 @@ bool Manager::FinishedRotation(WriterFrontend* writer, const char* new_name, con
 
 	int result = 0;
 
-	Val* v = func->Call(&vl);
+	auto v = func->Call(&vl);
 	if ( v )
-		{
 		result = v->AsBool();
-		Unref(v);
-		}
 
 	return result;
 	}
diff --git a/src/option.bif b/src/option.bif
index 5355216ee7..5202ed78db 100644
--- a/src/option.bif
+++ b/src/option.bif
@@ -23,7 +23,7 @@ static bool call_option_handlers_and_set_value(StringVal* name, ID* i, Val* val,
 			if ( add_loc )
 				vl.push_back(location->Ref());
 
-			val = handler_function->Call(&vl); // consumed by next call.
+			val = handler_function->Call(&vl).release(); // consumed by next call.
 			if ( ! val )
 				{
 				// Someone messed up, don't change value and just return
diff --git a/src/parse.y b/src/parse.y
index 0e0145776c..3f79e4331c 100644
--- a/src/parse.y
+++ b/src/parse.y
@@ -1261,8 +1261,8 @@ anonymous_function:
 			// a lambda expression.
 
 			// Gather the ingredients for a BroFunc from the current scope
-			auto ingredients = std::make_unique<function_ingredients>(current_scope(), $5);
-			id_list outer_ids = gather_outer_ids(pop_scope().get(), $5);
+			auto ingredients = std::make_unique<function_ingredients>(IntrusivePtr{NewRef{}, current_scope()}, IntrusivePtr{AdoptRef{}, $5});
+			id_list outer_ids = gather_outer_ids(pop_scope().get(), ingredients->body.get());
 
 			$$ = new LambdaExpr(std::move(ingredients), std::move(outer_ids));
 			}
diff --git a/src/zeek.bif b/src/zeek.bif
index 272e1aa117..6395f73ff5 100644
--- a/src/zeek.bif
+++ b/src/zeek.bif
@@ -1339,9 +1339,8 @@ bool sort_function(Val* a, Val* b)
 	sort_func_args.push_back(a->Ref());
 	sort_func_args.push_back(b->Ref());
 
-	Val* result = sort_function_comp->Call(&sort_func_args);
+	auto result = sort_function_comp->Call(&sort_func_args);
 	int int_result = result->CoerceToInt();
-	Unref(result);
 
 	return int_result < 0;
 	}