diff --git a/src/file_analysis/Analyzer.cc b/src/file_analysis/Analyzer.cc
index 963c4a693d..6ede6a969b 100644
--- a/src/file_analysis/Analyzer.cc
+++ b/src/file_analysis/Analyzer.cc
@@ -10,7 +10,6 @@ file_analysis::Analyzer::~Analyzer()
 	{
 	DBG_LOG(DBG_FILE_ANALYSIS, "Destroy file analyzer %s",
 	        file_mgr->GetComponentName(tag).c_str());
-	Unref(args);
 	}
 
 void file_analysis::Analyzer::SetAnalyzerTag(const file_analysis::Tag& arg_tag)
@@ -21,7 +20,7 @@ void file_analysis::Analyzer::SetAnalyzerTag(const file_analysis::Tag& arg_tag)
 
 file_analysis::Analyzer::Analyzer(file_analysis::Tag arg_tag, RecordVal* arg_args, File* arg_file)
 	: tag(arg_tag),
-	  args(arg_args->Ref()->AsRecordVal()),
+	  args({NewRef{}, arg_args}),
 	  file(arg_file),
 	  got_stream_delivery(false),
 	  skip(false)
diff --git a/src/file_analysis/Analyzer.h b/src/file_analysis/Analyzer.h
index 029a4df082..2426a7f7a1 100644
--- a/src/file_analysis/Analyzer.h
+++ b/src/file_analysis/Analyzer.h
@@ -95,7 +95,12 @@ public:
 	/**
 	 * @return the AnalyzerArgs associated with the analyzer.
 	 */
-	RecordVal* Args() const { return args; }
+	const IntrusivePtr<RecordVal>& GetArgs() const
+		{ return args; }
+
+	[[deprecated("Remove in v4.1.  Use GetArgs().")]]
+	RecordVal* Args() const
+		{ return args.get(); }
 
 	/**
 	 * @return the file_analysis::File object to which the analyzer is attached.
@@ -166,7 +171,7 @@ private:
 
 	ID id;	/**< Unique instance ID. */
 	file_analysis::Tag tag;	/**< The particular type of the analyzer instance. */
-	RecordVal* args;	/**< \c AnalyzerArgs val gives tunable analyzer params. */
+	IntrusivePtr<RecordVal> args;	/**< \c AnalyzerArgs val gives tunable analyzer params. */
 	File* file;	/**< The file to which the analyzer is attached. */
 	bool got_stream_delivery;
 	bool skip;
diff --git a/src/file_analysis/File.cc b/src/file_analysis/File.cc
index 52a1b20a1f..fabe76c98d 100644
--- a/src/file_analysis/File.cc
+++ b/src/file_analysis/File.cc
@@ -410,7 +410,7 @@ void File::DeliverStream(const u_char* data, uint64_t len)
 								bof_buffer.chunks[i]->Len()) )
 						{
 						a->SetSkip(true);
-						analyzers.QueueRemove(a->Tag(), a->Args());
+						analyzers.QueueRemove(a->Tag(), a->GetArgs().get());
 						}
 					}
 
@@ -427,7 +427,7 @@ void File::DeliverStream(const u_char* data, uint64_t len)
 			if ( ! a->DeliverStream(data, len) )
 				{
 				a->SetSkip(true);
-				analyzers.QueueRemove(a->Tag(), a->Args());
+				analyzers.QueueRemove(a->Tag(), a->GetArgs().get());
 				}
 			}
 		}
@@ -498,7 +498,7 @@ void File::DeliverChunk(const u_char* data, uint64_t len, uint64_t offset)
 			if ( ! a->DeliverChunk(data, len, offset) )
 				{
 				a->SetSkip(true);
-				analyzers.QueueRemove(a->Tag(), a->Args());
+				analyzers.QueueRemove(a->Tag(), a->GetArgs().get());
 				}
 			}
 		}
@@ -557,7 +557,7 @@ void File::EndOfFile()
 	while ( (a = analyzers.NextEntry(c)) )
 		{
 		if ( ! a->EndOfFile() )
-			analyzers.QueueRemove(a->Tag(), a->Args());
+			analyzers.QueueRemove(a->Tag(), a->GetArgs().get());
 		}
 
 	FileEvent(file_state_remove);
@@ -590,7 +590,7 @@ void File::Gap(uint64_t offset, uint64_t len)
 	while ( (a = analyzers.NextEntry(c)) )
 		{
 		if ( ! a->Undelivered(offset, len) )
-			analyzers.QueueRemove(a->Tag(), a->Args());
+			analyzers.QueueRemove(a->Tag(), a->GetArgs().get());
 		}
 
 	if ( FileEventAvailable(file_gap) )
diff --git a/src/file_analysis/analyzer/extract/Extract.cc b/src/file_analysis/analyzer/extract/Extract.cc
index 3b4c9ed8b0..2ba8e7926d 100644
--- a/src/file_analysis/analyzer/extract/Extract.cc
+++ b/src/file_analysis/analyzer/extract/Extract.cc
@@ -93,7 +93,7 @@ bool Extract::DeliverStream(const u_char* data, uint64_t len)
 		File* f = GetFile();
 		f->FileEvent(file_extraction_limit, {
 			f->ToVal(),
-			IntrusivePtr{NewRef{}, Args()},
+			GetArgs(),
 			val_mgr->Count(limit),
 			val_mgr->Count(len)
 		});