diff --git a/src/Expr.h b/src/Expr.h
index 6613ba7a45..9745445c9f 100644
--- a/src/Expr.h
+++ b/src/Expr.h
@@ -255,7 +255,7 @@ public:
     ZEEK_EXPR_ACCESSOR_DECLS(NameExpr)
     ZEEK_EXPR_ACCESSOR_DECLS(RefExpr)
 
-    void Describe(ODesc* d) const override final;
+    void Describe(ODesc* d) const final;
 
     virtual TraversalCode Traverse(TraversalCallback* cb) const = 0;
 
@@ -513,8 +513,8 @@ public:
     bool HasReducedOps(Reducer* c) const override;
     ExprPtr Reduce(Reducer* c, StmtPtr& red_stmt) override;
 
-    ExprPtr GetOp1() const override final { return op; }
-    void SetOp1(ExprPtr _op) override final { op = std::move(_op); }
+    ExprPtr GetOp1() const final { return op; }
+    void SetOp1(ExprPtr _op) final { op = std::move(_op); }
 
 protected:
     UnaryExpr(ExprTag arg_tag, ExprPtr arg_op);
@@ -549,11 +549,11 @@ public:
     bool HasReducedOps(Reducer* c) const override;
     ExprPtr Reduce(Reducer* c, StmtPtr& red_stmt) override;
 
-    ExprPtr GetOp1() const override final { return op1; }
-    ExprPtr GetOp2() const override final { return op2; }
+    ExprPtr GetOp1() const final { return op1; }
+    ExprPtr GetOp2() const final { return op2; }
 
-    void SetOp1(ExprPtr _op) override final { op1 = std::move(_op); }
-    void SetOp2(ExprPtr _op) override final { op2 = std::move(_op); }
+    void SetOp1(ExprPtr _op) final { op1 = std::move(_op); }
+    void SetOp2(ExprPtr _op) final { op2 = std::move(_op); }
 
 protected:
     BinaryExpr(ExprTag arg_tag, ExprPtr arg_op1, ExprPtr arg_op2)
@@ -932,13 +932,13 @@ public:
     ExprPtr Reduce(Reducer* c, StmtPtr& red_stmt) override;
     StmtPtr ReduceToSingletons(Reducer* c) override;
 
-    ExprPtr GetOp1() const override final { return op1; }
-    ExprPtr GetOp2() const override final { return op2; }
-    ExprPtr GetOp3() const override final { return op3; }
+    ExprPtr GetOp1() const final { return op1; }
+    ExprPtr GetOp2() const final { return op2; }
+    ExprPtr GetOp3() const final { return op3; }
 
-    void SetOp1(ExprPtr _op) override final { op1 = std::move(_op); }
-    void SetOp2(ExprPtr _op) override final { op2 = std::move(_op); }
-    void SetOp3(ExprPtr _op) override final { op3 = std::move(_op); }
+    void SetOp1(ExprPtr _op) final { op1 = std::move(_op); }
+    void SetOp2(ExprPtr _op) final { op2 = std::move(_op); }
+    void SetOp3(ExprPtr _op) final { op3 = std::move(_op); }
 
 protected:
     void ExprDescribe(ODesc* d) const override;
@@ -1400,11 +1400,11 @@ public:
     bool HasReducedOps(Reducer* c) const override;
     ExprPtr Reduce(Reducer* c, StmtPtr& red_stmt) override;
 
-    ExprPtr GetOp1() const override final;
-    ExprPtr GetOp2() const override final;
+    ExprPtr GetOp1() const final;
+    ExprPtr GetOp2() const final;
 
-    void SetOp1(ExprPtr _op) override final;
-    void SetOp2(ExprPtr _op) override final;
+    void SetOp1(ExprPtr _op) final;
+    void SetOp2(ExprPtr _op) final;
 
 protected:
     void ExprDescribe(ODesc* d) const override;
@@ -1599,8 +1599,8 @@ public:
     ExprPtr Reduce(Reducer* c, StmtPtr& red_stmt) override;
     StmtPtr ReduceToSingletons(Reducer* c) override;
 
-    ExprPtr GetOp1() const override final { return args; }
-    void SetOp1(ExprPtr _op) override final { args = {NewRef{}, _op->AsListExpr()}; }
+    ExprPtr GetOp1() const final { return args; }
+    void SetOp1(ExprPtr _op) final { args = {NewRef{}, _op->AsListExpr()}; }
 
 protected:
     void ExprDescribe(ODesc* d) const override;
diff --git a/src/MMDB.h b/src/MMDB.h
index e0dba80194..d9bd4a2815 100644
--- a/src/MMDB.h
+++ b/src/MMDB.h
@@ -70,14 +70,14 @@ private:
 
 class LocDB : public MMDB {
 public:
-    bool OpenFromScriptConfig();
-    std::string_view Description() { return "GeoIP location database"; }
+    bool OpenFromScriptConfig() override;
+    std::string_view Description() override { return "GeoIP location database"; }
 };
 
 class AsnDB : public MMDB {
 public:
-    bool OpenFromScriptConfig();
-    std::string_view Description() { return "GeoIP ASN database"; }
+    bool OpenFromScriptConfig() override;
+    std::string_view Description() override { return "GeoIP ASN database"; }
 };
 
 #endif // USE_GEOIP
diff --git a/src/OpaqueVal.h b/src/OpaqueVal.h
index 1b0294dd23..c539df76ff 100644
--- a/src/OpaqueVal.h
+++ b/src/OpaqueVal.h
@@ -236,7 +236,7 @@ public:
     }
 
     MD5Val();
-    ~MD5Val();
+    ~MD5Val() override;
 
     ValPtr DoClone(CloneState* state) override;
 
@@ -264,7 +264,7 @@ public:
     }
 
     SHA1Val();
-    ~SHA1Val();
+    ~SHA1Val() override;
 
     ValPtr DoClone(CloneState* state) override;
 
@@ -292,7 +292,7 @@ public:
     }
 
     SHA256Val();
-    ~SHA256Val();
+    ~SHA256Val() override;
 
     ValPtr DoClone(CloneState* state) override;
 
diff --git a/src/Timer.h b/src/Timer.h
index 509a6bec18..9cc2eadcdb 100644
--- a/src/Timer.h
+++ b/src/Timer.h
@@ -136,9 +136,9 @@ public:
     static unsigned int* CurrentTimers() { return current_timers; }
 
     // IOSource API methods
-    virtual double GetNextTimeout() override;
-    virtual void Process() override;
-    virtual const char* Tag() override { return "TimerMgr"; }
+    double GetNextTimeout() override;
+    void Process() override;
+    const char* Tag() override { return "TimerMgr"; }
 
     /**
      * Performs some extra initialization on a timer manager. This shouldn't
diff --git a/src/Trigger.h b/src/Trigger.h
index ad9929f238..9b8c1180f1 100644
--- a/src/Trigger.h
+++ b/src/Trigger.h
@@ -169,7 +169,7 @@ private:
 class Manager final : public iosource::IOSource {
 public:
     Manager();
-    ~Manager();
+    ~Manager() override;
 
     void InitPostScript();
 
diff --git a/src/Type.h b/src/Type.h
index 976c549257..d1d01b55c7 100644
--- a/src/Type.h
+++ b/src/Type.h
@@ -406,7 +406,7 @@ class TableType : public IndexType {
 public:
     TableType(TypeListPtr ind, TypePtr yield);
 
-    ~TableType();
+    ~TableType() override;
 
     /**
      * Assesses whether an &expire_func attribute's function type is compatible
diff --git a/src/analyzer/protocol/krb/KRB.h b/src/analyzer/protocol/krb/KRB.h
index d30490eb82..0fb15f81af 100644
--- a/src/analyzer/protocol/krb/KRB.h
+++ b/src/analyzer/protocol/krb/KRB.h
@@ -17,10 +17,10 @@ namespace zeek::analyzer::krb {
 class KRB_Analyzer final : public analyzer::Analyzer {
 public:
     explicit KRB_Analyzer(Connection* conn);
-    virtual ~KRB_Analyzer();
+    ~KRB_Analyzer() override;
 
-    virtual void Done();
-    virtual void DeliverPacket(int len, const u_char* data, bool orig, uint64_t seq, const IP_Hdr* ip, int caplen);
+    void Done() override;
+    void DeliverPacket(int len, const u_char* data, bool orig, uint64_t seq, const IP_Hdr* ip, int caplen) override;
 
     static analyzer::Analyzer* Instantiate(Connection* conn) { return new KRB_Analyzer(conn); }
 
diff --git a/src/analyzer/protocol/snmp/SNMP.h b/src/analyzer/protocol/snmp/SNMP.h
index 3800263ac9..d6a46f1696 100644
--- a/src/analyzer/protocol/snmp/SNMP.h
+++ b/src/analyzer/protocol/snmp/SNMP.h
@@ -10,10 +10,10 @@ namespace zeek::analyzer::snmp {
 class SNMP_Analyzer final : public analyzer::Analyzer {
 public:
     explicit SNMP_Analyzer(Connection* conn);
-    virtual ~SNMP_Analyzer();
+    ~SNMP_Analyzer() override;
 
-    virtual void Done();
-    virtual void DeliverPacket(int len, const u_char* data, bool orig, uint64_t seq, const IP_Hdr* ip, int caplen);
+    void Done() override;
+    void DeliverPacket(int len, const u_char* data, bool orig, uint64_t seq, const IP_Hdr* ip, int caplen) override;
 
     static analyzer::Analyzer* InstantiateAnalyzer(Connection* conn) { return new SNMP_Analyzer(conn); }
 
diff --git a/src/analyzer/protocol/websocket/WebSocket.h b/src/analyzer/protocol/websocket/WebSocket.h
index 394eab194e..81abe5a459 100644
--- a/src/analyzer/protocol/websocket/WebSocket.h
+++ b/src/analyzer/protocol/websocket/WebSocket.h
@@ -15,7 +15,7 @@ namespace zeek::analyzer::websocket {
 class WebSocket_Analyzer : public analyzer::tcp::TCP_ApplicationAnalyzer {
 public:
     WebSocket_Analyzer(zeek::Connection* conn);
-    ~WebSocket_Analyzer() = default;
+    ~WebSocket_Analyzer() override = default;
 
     /**
      * Allows script land to configure the WebSocket analyzer before analysis.
diff --git a/src/broker/WebSocketShim.h b/src/broker/WebSocketShim.h
index c896854d47..c2f1b9a6a8 100644
--- a/src/broker/WebSocketShim.h
+++ b/src/broker/WebSocketShim.h
@@ -26,7 +26,7 @@ class WebSocketShim : public zeek::cluster::Backend {
 public:
     WebSocketShim(std::unique_ptr<zeek::cluster::EventSerializer> es, std::unique_ptr<zeek::cluster::LogSerializer> ls,
                   std::unique_ptr<zeek::cluster::detail::EventHandlingStrategy> ehs);
-    ~WebSocketShim();
+    ~WebSocketShim() override;
 
     /**
      * Component factory.
diff --git a/src/cluster/backend/zeromq/ZeroMQ.h b/src/cluster/backend/zeromq/ZeroMQ.h
index dae822160b..0af5429a18 100644
--- a/src/cluster/backend/zeromq/ZeroMQ.h
+++ b/src/cluster/backend/zeromq/ZeroMQ.h
@@ -31,7 +31,7 @@ public:
     /**
      * Destructor.
      */
-    ~ZeroMQBackend();
+    ~ZeroMQBackend() override;
 
     /**
      * Spawns a thread running zmq_proxy() for the configured XPUB/XSUB listen
diff --git a/src/file_analysis/analyzer/pe/PE.h b/src/file_analysis/analyzer/pe/PE.h
index d2efe24ad7..3949032e31 100644
--- a/src/file_analysis/analyzer/pe/PE.h
+++ b/src/file_analysis/analyzer/pe/PE.h
@@ -13,15 +13,14 @@ namespace zeek::file_analysis::detail {
  */
 class PE : public file_analysis::Analyzer {
 public:
-    ~PE();
+    ~PE() override;
 
     static file_analysis::Analyzer* Instantiate(RecordValPtr args, file_analysis::File* file) {
         return new PE(std::move(args), file);
     }
 
-    virtual bool DeliverStream(const u_char* data, uint64_t len);
-
-    virtual bool EndOfFile();
+    bool DeliverStream(const u_char* data, uint64_t len) override;
+    bool EndOfFile() override;
 
 protected:
     PE(RecordValPtr args, file_analysis::File* file);
diff --git a/src/iosource/Manager.h b/src/iosource/Manager.h
index aac2144eb2..5b305f76a5 100644
--- a/src/iosource/Manager.h
+++ b/src/iosource/Manager.h
@@ -193,7 +193,7 @@ private:
     class WakeupHandler final : public IOSource {
     public:
         WakeupHandler();
-        ~WakeupHandler();
+        ~WakeupHandler() override;
 
         /**
          * Tells the handler to wake up the loop by firing the flare.
diff --git a/src/iosource/PktSrc.h b/src/iosource/PktSrc.h
index dbec7f0584..8ffea4472d 100644
--- a/src/iosource/PktSrc.h
+++ b/src/iosource/PktSrc.h
@@ -219,7 +219,7 @@ public:
      * poll should time out in seconds from the current time. Return
      * -1 if this should not be considered.
      */
-    virtual double GetNextTimeout() override;
+    double GetNextTimeout() override;
 
 protected:
     friend class Manager;
diff --git a/src/packet_analysis/protocol/ip/SessionAdapter.h b/src/packet_analysis/protocol/ip/SessionAdapter.h
index 4fca79da85..d3ed0859f8 100644
--- a/src/packet_analysis/protocol/ip/SessionAdapter.h
+++ b/src/packet_analysis/protocol/ip/SessionAdapter.h
@@ -24,7 +24,7 @@ public:
     /**
      * Overridden from parent class.
      */
-    virtual void Done() override;
+    void Done() override;
 
     /**
      * Sets the parent packet analyzer for this session adapter. This can't be passed to
diff --git a/src/script_opt/Expr.h b/src/script_opt/Expr.h
index 2e5f28bdfb..613daa3732 100644
--- a/src/script_opt/Expr.h
+++ b/src/script_opt/Expr.h
@@ -68,8 +68,8 @@ public:
     ExprPtr Reduce(Reducer* c, StmtPtr& red_stmt) override;
     ExprPtr ReduceToSingleton(Reducer* c, StmtPtr& red_stmt) override;
 
-    ExprPtr GetOp3() const override final { return op3; }
-    void SetOp3(ExprPtr _op) override final { op3 = std::move(_op); }
+    ExprPtr GetOp3() const final { return op3; }
+    void SetOp3(ExprPtr _op) final { op3 = std::move(_op); }
 
     TraversalCode Traverse(TraversalCallback* cb) const override;
 
@@ -246,11 +246,11 @@ public:
 
     auto Tag() const { return tag; }
 
-    ExprPtr GetOp1() const override final { return arg1; }
-    ExprPtr GetOp2() const override final { return arg2; }
+    ExprPtr GetOp1() const final { return arg1; }
+    ExprPtr GetOp2() const final { return arg2; }
 
-    void SetOp1(ExprPtr op) override final { arg1 = std::move(op); }
-    void SetOp2(ExprPtr op) override final { arg2 = std::move(op); }
+    void SetOp1(ExprPtr op) final { arg1 = std::move(op); }
+    void SetOp2(ExprPtr op) final { arg2 = std::move(op); }
 
     ValPtr Eval(Frame* f) const override;
 
diff --git a/src/session/Session.h b/src/session/Session.h
index 76e40cec78..157491f9d9 100644
--- a/src/session/Session.h
+++ b/src/session/Session.h
@@ -50,7 +50,7 @@ public:
     Session(double t, EventHandlerPtr timeout_event, EventHandlerPtr status_update_event = nullptr,
             double status_update_interval = 0);
 
-    virtual ~Session() {}
+    ~Session() override = default;
 
     /**
      * Invoked when the session is about to be removed. Use Ref(this)
@@ -135,7 +135,7 @@ public:
         return EnqueueEvent(h, analyzer, zeek::Args{std::forward<Args>(args)...});
     }
 
-    virtual void Describe(ODesc* d) const override;
+    void Describe(ODesc* d) const override;
 
     /**
      * Sets the session to expire after a given amount of time.
diff --git a/src/spicy/file-analyzer.h b/src/spicy/file-analyzer.h
index 2bb6506a88..0395c4b9f4 100644
--- a/src/spicy/file-analyzer.h
+++ b/src/spicy/file-analyzer.h
@@ -53,7 +53,7 @@ private:
 class FileAnalyzer : public file_analysis::Analyzer {
 public:
     FileAnalyzer(RecordValPtr arg_args, file_analysis::File* arg_file);
-    virtual ~FileAnalyzer();
+    ~FileAnalyzer() override;
 
     static file_analysis::Analyzer* InstantiateAnalyzer(RecordValPtr args, file_analysis::File* file);
 
diff --git a/src/spicy/manager.h b/src/spicy/manager.h
index 55f47c51fd..a1b776cdb6 100644
--- a/src/spicy/manager.h
+++ b/src/spicy/manager.h
@@ -63,7 +63,7 @@ inline void log(const std::string& msg) {
 class Manager : public zeek::plugin::Plugin {
 public:
     Manager() {}
-    virtual ~Manager();
+    ~Manager() override;
 
     /**
      * Runtime method to begin registration of a Spicy EVT module. All
diff --git a/src/spicy/packet-analyzer.h b/src/spicy/packet-analyzer.h
index 7d68e322db..8da37afbba 100644
--- a/src/spicy/packet-analyzer.h
+++ b/src/spicy/packet-analyzer.h
@@ -54,7 +54,7 @@ private:
 class PacketAnalyzer : public packet_analysis::Analyzer {
 public:
     PacketAnalyzer(std::string name);
-    virtual ~PacketAnalyzer();
+    ~PacketAnalyzer() override;
 
     /** Records a debug message. */
     void DebugMsg(const std::string& msg) { _state.DebugMsg(msg); }
diff --git a/src/spicy/protocol-analyzer.h b/src/spicy/protocol-analyzer.h
index df4115b587..8ea8bbbe82 100644
--- a/src/spicy/protocol-analyzer.h
+++ b/src/spicy/protocol-analyzer.h
@@ -123,7 +123,7 @@ private:
 class TCP_Analyzer : public ProtocolAnalyzer, public analyzer::tcp::TCP_ApplicationAnalyzer {
 public:
     TCP_Analyzer(Connection* conn);
-    virtual ~TCP_Analyzer();
+    ~TCP_Analyzer() override;
 
     // Overridden from Spicy's Analyzer.
     void Init() override;
@@ -151,7 +151,7 @@ public:
 class UDP_Analyzer : public ProtocolAnalyzer, public analyzer::Analyzer {
 public:
     UDP_Analyzer(Connection* conn);
-    virtual ~UDP_Analyzer();
+    ~UDP_Analyzer() override;
 
     // Overridden from Spicy's Analyzer.
     void Init() override;
diff --git a/src/supervisor/Supervisor.h b/src/supervisor/Supervisor.h
index 64d492fb22..c433c0536a 100644
--- a/src/supervisor/Supervisor.h
+++ b/src/supervisor/Supervisor.h
@@ -241,7 +241,7 @@ public:
     /**
      * Destruction also cleanly shuts down the entire supervised process tree.
      */
-    ~Supervisor();
+    ~Supervisor() override;
 
     /**
      * Perform some initialization that needs to happen after scripts are loaded
diff --git a/src/telemetry/Manager.h b/src/telemetry/Manager.h
index 0d90d9e4ad..a25387a710 100644
--- a/src/telemetry/Manager.h
+++ b/src/telemetry/Manager.h
@@ -47,7 +47,7 @@ public:
     Manager(const Manager&) = delete;
     Manager& operator=(const Manager&) = delete;
 
-    ~Manager();
+    ~Manager() override;
 
     /**
      * Initialization of the manager. This is called late during Zeek's
diff --git a/src/threading/Manager.h b/src/threading/Manager.h
index 6eaefe5771..12f30c50d5 100644
--- a/src/threading/Manager.h
+++ b/src/threading/Manager.h
@@ -26,7 +26,7 @@ namespace detail {
 class HeartbeatTimer final : public zeek::detail::Timer {
 public:
     HeartbeatTimer(double t) : zeek::detail::Timer(t, zeek::detail::TIMER_THREAD_HEARTBEAT) {}
-    virtual ~HeartbeatTimer() {}
+    ~HeartbeatTimer() override = default;
 
     void Dispatch(double t, bool is_expire) override;
 
diff --git a/src/threading/MsgThread.h b/src/threading/MsgThread.h
index 0e486cf592..705888c310 100644
--- a/src/threading/MsgThread.h
+++ b/src/threading/MsgThread.h
@@ -54,7 +54,7 @@ public:
     /**
      * Destructor.
      */
-    virtual ~MsgThread();
+    ~MsgThread() override;
 
     /**
      * Sends a message to the child thread. The message will be processed
diff --git a/src/threading/formatters/Ascii.h b/src/threading/formatters/Ascii.h
index 800ec3fb98..f64318b580 100644
--- a/src/threading/formatters/Ascii.h
+++ b/src/threading/formatters/Ascii.h
@@ -46,10 +46,10 @@ public:
     Ascii(MsgThread* t, const SeparatorInfo& info);
     ~Ascii() override = default;
 
-    virtual bool Describe(ODesc* desc, Value* val, const std::string& name = "") const override;
-    virtual bool Describe(ODesc* desc, int num_fields, const Field* const* fields, Value** vals) const override;
-    virtual Value* ParseValue(const std::string& s, const std::string& name, TypeTag type,
-                              TypeTag subtype = TYPE_ERROR) const override;
+    bool Describe(ODesc* desc, Value* val, const std::string& name = "") const override;
+    bool Describe(ODesc* desc, int num_fields, const Field* const* fields, Value** vals) const override;
+    Value* ParseValue(const std::string& s, const std::string& name, TypeTag type,
+                      TypeTag subtype = TYPE_ERROR) const override;
 
 private:
     bool CheckNumberError(const char* start, const char* end, bool nonneg_only = false) const;