diff --git a/src/Expr.cc b/src/Expr.cc
index 3c954ee5bb..9d8e041d72 100644
--- a/src/Expr.cc
+++ b/src/Expr.cc
@@ -218,7 +218,7 @@ NameExpr::NameExpr(IntrusivePtr<ID> arg_id, bool const_init)
 	in_const_init = const_init;
 
 	if ( id->AsType() )
-		SetType(make_intrusive<TypeType>(id->AsType()));
+		SetType(make_intrusive<TypeType>(IntrusivePtr{NewRef{}, id->AsType()}));
 	else
 		SetType({NewRef{}, id->Type()});
 
diff --git a/src/Type.h b/src/Type.h
index c92768a26c..0a1382a6a5 100644
--- a/src/Type.h
+++ b/src/Type.h
@@ -468,16 +468,13 @@ protected:
 
 class TypeType : public BroType {
 public:
-	explicit TypeType(BroType* t) : BroType(TYPE_TYPE)	{ type = t->Ref(); }
+	explicit TypeType(IntrusivePtr<BroType> t) : BroType(TYPE_TYPE), type(std::move(t)) {}
 	TypeType* ShallowClone() override { return new TypeType(type); }
-	~TypeType() override { Unref(type); }
 
-	BroType* Type()	{ return type; }
+	BroType* Type()	{ return type.get(); }
 
 protected:
-	TypeType()	{}
-
-	BroType* type;
+	IntrusivePtr<BroType> type;
 };
 
 class TypeDecl {
diff --git a/src/Val.h b/src/Val.h
index c4e69ddd9a..b897d5ec6e 100644
--- a/src/Val.h
+++ b/src/Val.h
@@ -141,7 +141,7 @@ public:
 
 	// Extra arg to differentiate from protected version.
 	Val(BroType* t, bool type_type)
-		: type(new TypeType(t->Ref()))
+		: type(new TypeType({NewRef{}, t}))
 		{
 		}