diff --git a/c-gull/src/nss.rs b/c-gull/src/nss.rs
index 7eb6ae5..01b13c3 100644
--- a/c-gull/src/nss.rs
+++ b/c-gull/src/nss.rs
@@ -9,7 +9,7 @@
 
 use core::ffi::CStr;
 use core::mem::{align_of, zeroed};
-use core::ptr::{copy_nonoverlapping, null, null_mut, write};
+use core::ptr::{addr_of_mut, copy_nonoverlapping, null, null_mut, write};
 use core::str;
 use core::str::FromStr;
 use errno::{set_errno, Errno};
@@ -677,7 +677,7 @@ unsafe fn getserv_r(
     // musl returns just the protocol name as the alias list. The intersection
     // of these two that portable code is obliged to assume is an empty list.
     static mut STATIC_SERVENT_ALIASES: *mut c_char = null_mut();
-    let s_aliases = &mut STATIC_SERVENT_ALIASES;
+    let s_aliases = &mut *addr_of_mut!(STATIC_SERVENT_ALIASES);
 
     let mut command = command;
     let output = match command.output() {
@@ -806,7 +806,15 @@ unsafe extern "C" fn getservbyname(
     libc!(libc::getservbyname(name, proto));
 
     let mut result = null_mut();
-    if getservbyname_r(name, proto, &mut STATIC_SERVENT, null_mut(), 0, &mut result) == 0 {
+    if getservbyname_r(
+        name,
+        proto,
+        addr_of_mut!(STATIC_SERVENT),
+        null_mut(),
+        0,
+        &mut result,
+    ) == 0
+    {
         result
     } else {
         null_mut()
@@ -822,7 +830,7 @@ unsafe extern "C" fn getservbyport(port: c_int, proto: *const c_char) -> *mut li
     if getservbyport_r(
         port,
         proto,
-        &mut STATIC_SERVENT,
+        addr_of_mut!(STATIC_SERVENT),
         buf.as_mut_ptr(),
         buf.len(),
         &mut result,
diff --git a/c-gull/src/termios_.rs b/c-gull/src/termios_.rs
index fbf90d9..1c0dbc9 100644
--- a/c-gull/src/termios_.rs
+++ b/c-gull/src/termios_.rs
@@ -6,7 +6,6 @@
 
 use crate::convert_res;
 use alloc::ffi::CString;
-use alloc::vec::Vec;
 use core::cell::SyncUnsafeCell;
 use core::ptr::{copy_nonoverlapping, null_mut};
 use libc::{c_char, c_int, size_t};
diff --git a/c-scape/Cargo.toml b/c-scape/Cargo.toml
index 26b5787..05e0e1e 100644
--- a/c-scape/Cargo.toml
+++ b/c-scape/Cargo.toml
@@ -23,7 +23,7 @@ rustix = { version = "0.38.31", default-features = false, features = ["event", "
 rustix-futex-sync = { version = "0.2.1", features = ["atomic_usize"] }
 memoffset = "0.9.0"
 realpath-ext = { version = "0.1.0", default-features = false }
-origin = { version = "0.17.0", default-features = false, features = ["thread", "init-fini-arrays", "alloc"] }
+origin = { version = "0.18.1", default-features = false, features = ["thread", "init-fini-arrays", "alloc"] }
 # We use the libc crate for C ABI types and constants, but we don't depend on
 # the actual platform libc.
 libc = { version = "0.2.138", default-features = false }
@@ -64,7 +64,7 @@ static_assertions = "1.1.0"
 
 [features]
 default = ["thread", "std", "coexist-with-libc", "threadsafe-setenv", "use-compiler-builtins"]
-thread = ["origin/set_thread_id"]
+thread = []
 std = ["rustix/std", "printf-compat/std"]
 
 # In "take-charge" mode, this enables code in c-scape to define the
diff --git a/c-scape/src/brk.rs b/c-scape/src/brk.rs
index 43e221f..156076a 100644
--- a/c-scape/src/brk.rs
+++ b/c-scape/src/brk.rs
@@ -1,5 +1,5 @@
 use crate::convert_res;
-use core::ptr::{invalid_mut, null_mut};
+use core::ptr::{null_mut, without_provenance_mut};
 use errno::{set_errno, Errno};
 use libc::{c_int, c_void, intptr_t};
 
@@ -35,7 +35,7 @@ unsafe extern "C" fn sbrk(increment: intptr_t) -> *mut c_void {
         // Read the current value from the OS.
         old = match convert_res(rustix::runtime::brk(null_mut())) {
             Some(old) => old,
-            None => return invalid_mut(!0),
+            None => return without_provenance_mut(!0),
         };
     }
 
@@ -57,7 +57,7 @@ unsafe extern "C" fn sbrk(increment: intptr_t) -> *mut c_void {
     if !ok {
         CURRENT = old;
         set_errno(Errno(libc::ENOMEM));
-        return invalid_mut(!0);
+        return without_provenance_mut(!0);
     }
 
     // Install the new address.
@@ -65,7 +65,7 @@ unsafe extern "C" fn sbrk(increment: intptr_t) -> *mut c_void {
         Some(new) => new,
         None => {
             CURRENT = old;
-            return invalid_mut(!0);
+            return without_provenance_mut(!0);
         }
     };
 
@@ -74,7 +74,7 @@ unsafe extern "C" fn sbrk(increment: intptr_t) -> *mut c_void {
     // The `brk` syscall returns the old value if it failed.
     if new != want {
         set_errno(Errno(libc::ENOMEM));
-        return invalid_mut(!0);
+        return without_provenance_mut(!0);
     }
 
     old
diff --git a/c-scape/src/errno_.rs b/c-scape/src/errno_.rs
index 99a754d..f5fb970 100644
--- a/c-scape/src/errno_.rs
+++ b/c-scape/src/errno_.rs
@@ -1,7 +1,7 @@
 use alloc::borrow::ToOwned;
 use alloc::format;
 use core::cell::SyncUnsafeCell;
-use core::ptr::{copy_nonoverlapping, null_mut};
+use core::ptr::{addr_of_mut, copy_nonoverlapping, null_mut};
 use libc::{c_char, c_int};
 
 /// Return the address of the thread-local `errno` state.
@@ -15,7 +15,7 @@ unsafe extern "C" fn __errno_location() -> *mut c_int {
 
     #[cfg_attr(feature = "thread", thread_local)]
     static mut ERRNO: i32 = 0;
-    &mut ERRNO
+    addr_of_mut!(ERRNO)
 }
 
 #[no_mangle]
diff --git a/c-scape/src/fs/dir/readdir.rs b/c-scape/src/fs/dir/readdir.rs
index 9fe4990..8557da3 100644
--- a/c-scape/src/fs/dir/readdir.rs
+++ b/c-scape/src/fs/dir/readdir.rs
@@ -1,4 +1,3 @@
-use core::convert::TryInto;
 use core::mem::transmute;
 use core::ptr::null_mut;
 
diff --git a/c-scape/src/fs/lseek.rs b/c-scape/src/fs/lseek.rs
index 7aadffb..b37e53d 100644
--- a/c-scape/src/fs/lseek.rs
+++ b/c-scape/src/fs/lseek.rs
@@ -1,5 +1,4 @@
 use crate::convert_res;
-use core::convert::TryInto;
 use errno::{set_errno, Errno};
 use libc::{c_int, off64_t, off_t};
 use rustix::fd::BorrowedFd;
diff --git a/c-scape/src/fs/stat.rs b/c-scape/src/fs/stat.rs
index db2e916..ac4b972 100644
--- a/c-scape/src/fs/stat.rs
+++ b/c-scape/src/fs/stat.rs
@@ -1,4 +1,3 @@
-use core::convert::TryInto;
 use core::ffi::CStr;
 use core::mem::size_of_val;
 use core::ptr::{addr_of, addr_of_mut, copy_nonoverlapping};
diff --git a/c-scape/src/fs/xattr.rs b/c-scape/src/fs/xattr.rs
index 99720be..f174e33 100644
--- a/c-scape/src/fs/xattr.rs
+++ b/c-scape/src/fs/xattr.rs
@@ -3,7 +3,7 @@
 use crate::{convert_res, READ_BUFFER};
 use core::cmp::min;
 use core::ffi::CStr;
-use core::ptr::copy_nonoverlapping;
+use core::ptr::{addr_of_mut, copy_nonoverlapping};
 use core::slice;
 use libc::{c_char, c_int, c_void, size_t, ssize_t};
 use rustix::fd::BorrowedFd;
@@ -26,7 +26,7 @@ unsafe extern "C" fn getxattr(
     match convert_res(rustix::fs::getxattr(
         path,
         name,
-        &mut READ_BUFFER[..min(len, READ_BUFFER.len())],
+        &mut *addr_of_mut!(READ_BUFFER[..min(len, READ_BUFFER.len())]),
     )) {
         Some(size) => {
             // If `size` is 0, `value` could be null.
@@ -56,7 +56,7 @@ unsafe extern "C" fn lgetxattr(
     match convert_res(rustix::fs::lgetxattr(
         path,
         name,
-        &mut READ_BUFFER[..min(len, READ_BUFFER.len())],
+        &mut *addr_of_mut!(READ_BUFFER[..min(len, READ_BUFFER.len())]),
     )) {
         Some(size) => {
             // If `size` is 0, `value` could be null.
@@ -86,7 +86,7 @@ unsafe extern "C" fn fgetxattr(
     match convert_res(rustix::fs::fgetxattr(
         fd,
         name,
-        &mut READ_BUFFER[..min(len, READ_BUFFER.len())],
+        &mut *addr_of_mut!(READ_BUFFER[..min(len, READ_BUFFER.len())]),
     )) {
         Some(size) => {
             // If `size` is 0, `value` could be null.
@@ -169,7 +169,7 @@ unsafe extern "C" fn listxattr(path: *const c_char, list: *mut c_char, len: size
     // a slice, use a temporary copy.
     match convert_res(rustix::fs::listxattr(
         path,
-        &mut READ_BUFFER[..min(len, READ_BUFFER.len())],
+        &mut *addr_of_mut!(READ_BUFFER[..min(len, READ_BUFFER.len())]),
     )) {
         Some(size) => {
             // If `size` is 0, `value` could be null.
@@ -192,7 +192,7 @@ unsafe extern "C" fn llistxattr(path: *const c_char, list: *mut c_char, len: siz
     // a slice, use a temporary copy.
     match convert_res(rustix::fs::llistxattr(
         path,
-        &mut READ_BUFFER[..min(len, READ_BUFFER.len())],
+        &mut *addr_of_mut!(READ_BUFFER[..min(len, READ_BUFFER.len())]),
     )) {
         Some(size) => {
             // If `size` is 0, `value` could be null.
@@ -215,7 +215,7 @@ unsafe extern "C" fn flistxattr(fd: c_int, list: *mut c_char, len: size_t) -> ss
     // a slice, use a temporary copy.
     match convert_res(rustix::fs::flistxattr(
         fd,
-        &mut READ_BUFFER[..min(len, READ_BUFFER.len())],
+        &mut *addr_of_mut!(READ_BUFFER[..min(len, READ_BUFFER.len())]),
     )) {
         Some(size) => {
             // If `size` is 0, `value` could be null.
diff --git a/c-scape/src/io/mod.rs b/c-scape/src/io/mod.rs
index 979faa1..f2ada4b 100644
--- a/c-scape/src/io/mod.rs
+++ b/c-scape/src/io/mod.rs
@@ -15,7 +15,6 @@ mod write;
 use rustix::event::EventfdFlags;
 use rustix::fd::{BorrowedFd, IntoRawFd};
 
-use core::convert::TryInto;
 use libc::{c_int, c_long, c_uint};
 
 use crate::convert_res;
diff --git a/c-scape/src/io/poll.rs b/c-scape/src/io/poll.rs
index 733ebac..e6dba1e 100644
--- a/c-scape/src/io/poll.rs
+++ b/c-scape/src/io/poll.rs
@@ -1,4 +1,3 @@
-use core::convert::TryInto;
 use core::slice;
 use libc::c_int;
 
diff --git a/c-scape/src/lib.rs b/c-scape/src/lib.rs
index 5492585..2aba49b 100644
--- a/c-scape/src/lib.rs
+++ b/c-scape/src/lib.rs
@@ -7,7 +7,6 @@
 #![feature(exposed_provenance)]
 #![feature(inline_const)]
 #![feature(sync_unsafe_cell)]
-#![feature(ip_in_core)]
 #![feature(linkage)]
 #![deny(fuzzy_provenance_casts, lossy_provenance_casts)]
 
diff --git a/c-scape/src/net/mod.rs b/c-scape/src/net/mod.rs
index 6a1a499..a2bd387 100644
--- a/c-scape/src/net/mod.rs
+++ b/c-scape/src/net/mod.rs
@@ -1,7 +1,6 @@
 mod inet;
 
 use core::cmp::min;
-use core::convert::TryInto;
 use core::ffi::c_void;
 #[cfg(not(target_os = "wasi"))]
 use core::mem::size_of;
diff --git a/c-scape/src/process_.rs b/c-scape/src/process_.rs
index fcf9338..0f871de 100644
--- a/c-scape/src/process_.rs
+++ b/c-scape/src/process_.rs
@@ -189,8 +189,8 @@ unsafe extern "C" fn __getauxval(type_: c_ulong) -> *mut c_void {
 #[cfg(feature = "take-charge")]
 fn _getauxval(type_: c_ulong) -> *mut c_void {
     match type_ {
-        libc::AT_HWCAP => ptr::invalid_mut(rustix::param::linux_hwcap().0),
-        libc::AT_HWCAP2 => ptr::invalid_mut(rustix::param::linux_hwcap().1),
+        libc::AT_HWCAP => ptr::without_provenance_mut(rustix::param::linux_hwcap().0),
+        libc::AT_HWCAP2 => ptr::without_provenance_mut(rustix::param::linux_hwcap().1),
         _ => todo!("unrecognized __getauxval {}", type_),
     }
 }
diff --git a/c-scape/src/syscall.rs b/c-scape/src/syscall.rs
index c994782..15c09e9 100644
--- a/c-scape/src/syscall.rs
+++ b/c-scape/src/syscall.rs
@@ -2,9 +2,9 @@
 use crate::convert_res;
 #[cfg(feature = "thread")]
 use core::mem::zeroed;
-use core::ptr::invalid_mut;
 #[cfg(feature = "thread")]
 use core::ptr::null;
+use core::ptr::without_provenance_mut;
 use errno::{set_errno, Errno};
 #[cfg(feature = "extra-syscalls")]
 use libc::{c_char, size_t};
@@ -23,14 +23,14 @@ unsafe extern "C" fn syscall(number: c_long, mut args: ...) -> *mut c_void {
             let fd = args.arg::<c_int>();
             let buf = args.arg::<*mut c_void>();
             let count = args.arg::<size_t>();
-            invalid_mut(libc::read(fd, buf, count) as _)
+            without_provenance_mut(libc::read(fd, buf, count) as _)
         }
         #[cfg(feature = "syscall-write")]
         libc::SYS_write => {
             let fd = args.arg::<c_int>();
             let buf = args.arg::<*const c_void>();
             let count = args.arg::<size_t>();
-            invalid_mut(libc::write(fd, buf, count) as _)
+            without_provenance_mut(libc::write(fd, buf, count) as _)
         }
         #[cfg(feature = "syscall-open")]
         #[cfg(not(any(target_arch = "aarch64", target_arch = "riscv64")))]
@@ -45,7 +45,7 @@ unsafe extern "C" fn syscall(number: c_long, mut args: ...) -> *mut c_void {
             } else {
                 libc::open(path, flags)
             };
-            invalid_mut(fd as _)
+            without_provenance_mut(fd as _)
         }
         #[cfg(feature = "syscall-openat")]
         libc::SYS_openat => {
@@ -60,15 +60,17 @@ unsafe extern "C" fn syscall(number: c_long, mut args: ...) -> *mut c_void {
             } else {
                 libc::openat(dirfd, path, flags)
             };
-            invalid_mut(fd as _)
+            without_provenance_mut(fd as _)
         }
         #[cfg(feature = "syscall-close")]
         libc::SYS_close => {
             let fd = args.arg::<c_int>();
-            invalid_mut(libc::close(fd) as _)
+            without_provenance_mut(libc::close(fd) as _)
         }
         #[cfg(feature = "syscall-getpid")]
-        libc::SYS_getpid => invalid_mut(rustix::process::getpid().as_raw_nonzero().get() as _),
+        libc::SYS_getpid => {
+            without_provenance_mut(rustix::process::getpid().as_raw_nonzero().get() as _)
+        }
         #[cfg(feature = "syscall-statx")]
         libc::SYS_statx => {
             let dirfd = args.arg::<c_int>();
@@ -76,13 +78,13 @@ unsafe extern "C" fn syscall(number: c_long, mut args: ...) -> *mut c_void {
             let flags = args.arg::<c_int>();
             let mask = args.arg::<libc::c_uint>();
             let statxbuf = args.arg::<*mut libc::statx>();
-            invalid_mut(libc::statx(dirfd, path, flags, mask, statxbuf) as _)
+            without_provenance_mut(libc::statx(dirfd, path, flags, mask, statxbuf) as _)
         }
         libc::SYS_getrandom => {
             let buf = args.arg::<*mut c_void>();
             let len = args.arg::<usize>();
             let flags = args.arg::<u32>();
-            invalid_mut(libc::getrandom(buf, len, flags) as _)
+            without_provenance_mut(libc::getrandom(buf, len, flags) as _)
         }
         #[cfg(feature = "thread")]
         libc::SYS_futex => {
@@ -92,23 +94,25 @@ unsafe extern "C" fn syscall(number: c_long, mut args: ...) -> *mut c_void {
             let timeout = args.arg::<*const libc::timespec>();
             let uaddr2 = args.arg::<*mut u32>();
             let val3 = args.arg::<u32>();
-            invalid_mut(futex(uaddr, futex_op, val, timeout, uaddr2, val3) as isize as usize)
+            without_provenance_mut(
+                futex(uaddr, futex_op, val, timeout, uaddr2, val3) as isize as usize
+            )
         }
         libc::SYS_clone3 => {
             // ensure std::process uses fork as fallback code on linux
             set_errno(Errno(libc::ENOSYS));
-            invalid_mut(!0)
+            without_provenance_mut(!0)
         }
         #[cfg(feature = "syscall-epoll_create1")]
         libc::SYS_epoll_create1 => {
             let flags = args.arg::<c_int>();
-            invalid_mut(libc::epoll_create(flags) as isize as usize)
+            without_provenance_mut(libc::epoll_create(flags) as isize as usize)
         }
         #[cfg(feature = "syscall-timerfd_create")]
         libc::SYS_timerfd_create => {
             let clockid = args.arg::<c_int>();
             let flags = args.arg::<c_int>();
-            invalid_mut(libc::timerfd_create(clockid, flags) as isize as usize)
+            without_provenance_mut(libc::timerfd_create(clockid, flags) as isize as usize)
         }
         #[cfg(feature = "syscall-timerfd_settime")]
         libc::SYS_timerfd_settime => {
@@ -116,7 +120,9 @@ unsafe extern "C" fn syscall(number: c_long, mut args: ...) -> *mut c_void {
             let flags = args.arg::<c_int>();
             let new_value = args.arg::<*const libc::itimerspec>();
             let old_value = args.arg::<*mut libc::itimerspec>();
-            invalid_mut(libc::timerfd_settime(fd, flags, new_value, old_value) as isize as usize)
+            without_provenance_mut(
+                libc::timerfd_settime(fd, flags, new_value, old_value) as isize as usize,
+            )
         }
         #[cfg(feature = "syscall-utimensat")]
         libc::SYS_utimensat => {
@@ -129,34 +135,34 @@ unsafe extern "C" fn syscall(number: c_long, mut args: ...) -> *mut c_void {
             if path.is_null() {
                 if flags != 0 {
                     set_errno(Errno(libc::EINVAL));
-                    invalid_mut(-1 as isize as usize)
+                    without_provenance_mut(-1 as isize as usize)
                 } else {
-                    invalid_mut(libc::futimens(fd, times) as isize as usize)
+                    without_provenance_mut(libc::futimens(fd, times) as isize as usize)
                 }
             } else {
-                invalid_mut(libc::utimensat(fd, path, times, flags) as isize as usize)
+                without_provenance_mut(libc::utimensat(fd, path, times, flags) as isize as usize)
             }
         }
         #[cfg(feature = "syscall-fdatasync")]
         libc::SYS_fdatasync => {
             let fd = args.arg::<c_int>();
-            invalid_mut(libc::fdatasync(fd) as isize as usize)
+            without_provenance_mut(libc::fdatasync(fd) as isize as usize)
         }
         #[cfg(feature = "syscall-syncfs")]
         libc::SYS_syncfs => {
             let fd = args.arg::<c_int>();
-            invalid_mut(libc::syncfs(fd) as isize as usize)
+            without_provenance_mut(libc::syncfs(fd) as isize as usize)
         }
         #[cfg(feature = "syscall-sync")]
         libc::SYS_sync => {
             libc::sync();
-            invalid_mut(0)
+            without_provenance_mut(0)
         }
         #[cfg(feature = "syscall-pipe2")]
         libc::SYS_pipe2 => {
             let pipefd = args.arg::<*mut c_int>();
             let flags = args.arg::<c_int>();
-            invalid_mut(libc::pipe2(pipefd, flags) as isize as usize)
+            without_provenance_mut(libc::pipe2(pipefd, flags) as isize as usize)
         }
         _ => unimplemented!(
             "syscall({:?}); maybe try enabling the \"extra-syscalls\" feature",
diff --git a/c-scape/src/thread/mod.rs b/c-scape/src/thread/mod.rs
index 4076546..56f9737 100644
--- a/c-scape/src/thread/mod.rs
+++ b/c-scape/src/thread/mod.rs
@@ -3,7 +3,6 @@ mod key;
 use crate::GetThreadId;
 use alloc::boxed::Box;
 use alloc::format;
-use core::convert::TryInto;
 use core::ffi::c_void;
 use core::mem::{align_of, size_of, transmute, zeroed, ManuallyDrop, MaybeUninit};
 use core::ptr::{self, copy_nonoverlapping, null_mut, NonNull};
diff --git a/c-scape/src/time/mod.rs b/c-scape/src/time/mod.rs
index 9e626be..8ee06e1 100644
--- a/c-scape/src/time/mod.rs
+++ b/c-scape/src/time/mod.rs
@@ -1,5 +1,3 @@
-use core::convert::TryInto;
-
 use errno::{set_errno, Errno};
 use libc::{c_int, c_uint};
 
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index 04f37c3..c9a29fc 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,3 +1,3 @@
 [toolchain]
-channel = "nightly-2023-12-19"
+channel = "nightly-2024-02-26"
 components = ["rustc", "cargo", "rust-std", "rust-src", "rustfmt"]
diff --git a/tests/example_crates.rs b/tests/example_crates.rs
index 1a7e746..d369767 100644
--- a/tests/example_crates.rs
+++ b/tests/example_crates.rs
@@ -1,8 +1,6 @@
 //! Run the programs in the `example-crates` directory and compare their
 //! outputs with expected outputs.
 
-#![feature(cfg_target_abi)]
-
 use std::sync::OnceLock;
 
 fn test_crate(