diff --git a/Cargo.toml b/Cargo.toml
index 5a0d56a43..9f78b3f8c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,7 @@ authors = ["The Cloud Hypervisor Authors"]
 build = "build.rs"
 default-run = "cloud-hypervisor"
 description = "Open source Virtual Machine Monitor (VMM) that runs on top of KVM & MSHV"
-edition = "2021"
+edition = "2024"
 homepage = "https://github.com/cloud-hypervisor/cloud-hypervisor"
 license = "Apache-2.0 AND BSD-3-Clause"
 name = "cloud-hypervisor"
@@ -102,6 +102,7 @@ members = [
   "vm-virtio",
   "vmm",
 ]
+package.edition = "2024"
 
 [workspace.dependencies]
 # rust-vmm crates
diff --git a/api_client/Cargo.toml b/api_client/Cargo.toml
index 630f1b4c4..429ecbf92 100644
--- a/api_client/Cargo.toml
+++ b/api_client/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 authors = ["The Cloud Hypervisor Authors"]
-edition = "2021"
+edition.workspace = true
 name = "api_client"
 version = "0.1.0"
 
diff --git a/arch/Cargo.toml b/arch/Cargo.toml
index 4739c14f3..3bd32affb 100644
--- a/arch/Cargo.toml
+++ b/arch/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 authors = ["The Chromium OS Authors"]
-edition = "2021"
+edition.workspace = true
 name = "arch"
 version = "0.1.0"
 
diff --git a/block/Cargo.toml b/block/Cargo.toml
index 9e0505921..db4ac9a6b 100644
--- a/block/Cargo.toml
+++ b/block/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 authors = ["The Chromium OS Authors", "The Cloud Hypervisor Authors"]
-edition = "2021"
+edition.workspace = true
 name = "block"
 version = "0.1.0"
 
diff --git a/devices/Cargo.toml b/devices/Cargo.toml
index 2b985085f..bf620eca9 100644
--- a/devices/Cargo.toml
+++ b/devices/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 authors = ["The Chromium OS Authors"]
-edition = "2021"
+edition.workspace = true
 name = "devices"
 version = "0.1.0"
 
diff --git a/devices/src/pvmemcontrol.rs b/devices/src/pvmemcontrol.rs
index d119a21a1..ff2190933 100644
--- a/devices/src/pvmemcontrol.rs
+++ b/devices/src/pvmemcontrol.rs
@@ -137,7 +137,8 @@ impl PvmemcontrolTransport {
     }
 
     unsafe fn as_register(self) -> PvmemcontrolTransportRegister {
-        self.payload.register
+        // SAFETY: We access initialized data.
+        unsafe { self.payload.register }
     }
 }
 
diff --git a/event_monitor/Cargo.toml b/event_monitor/Cargo.toml
index af6333504..b2b7a4e48 100644
--- a/event_monitor/Cargo.toml
+++ b/event_monitor/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 authors = ["The Cloud Hypervisor Authors"]
-edition = "2021"
+edition.workspace = true
 name = "event_monitor"
 version = "0.1.0"
 
diff --git a/hypervisor/Cargo.toml b/hypervisor/Cargo.toml
index bdfefdeef..c756cf9fc 100644
--- a/hypervisor/Cargo.toml
+++ b/hypervisor/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 authors = ["Microsoft Authors"]
-edition = "2021"
+edition.workspace = true
 license = "Apache-2.0 OR BSD-3-Clause"
 name = "hypervisor"
 version = "0.1.0"
diff --git a/net_gen/Cargo.toml b/net_gen/Cargo.toml
index c0edc1155..b1443c1f2 100644
--- a/net_gen/Cargo.toml
+++ b/net_gen/Cargo.toml
@@ -1,6 +1,7 @@
 [package]
 authors = ["The Chromium OS Authors"]
 edition = "2021"
+#edition.workspace = true
 name = "net_gen"
 version = "0.1.0"
 
diff --git a/net_util/Cargo.toml b/net_util/Cargo.toml
index 74ad34208..8f5df7222 100644
--- a/net_util/Cargo.toml
+++ b/net_util/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 authors = ["The Chromium OS Authors"]
-edition = "2021"
+edition.workspace = true
 name = "net_util"
 version = "0.1.0"
 
diff --git a/net_util/src/tap.rs b/net_util/src/tap.rs
index 533d6a45b..591dbc491 100644
--- a/net_util/src/tap.rs
+++ b/net_util/src/tap.rs
@@ -133,7 +133,8 @@ impl Tap {
     /// The caller should ensure to pass a valid file descriptor and valid
     /// arguments for the `ioctl()` syscall.
     unsafe fn ioctl_with_mut_ref<F: AsRawFd, T>(fd: &F, req: c_ulong, arg: &mut T) -> Result<()> {
-        let ret = ioctl_with_mut_ref(fd, req, arg);
+        // SAFETY: file descriptor is valid and return value is checked
+        let ret = unsafe { ioctl_with_mut_ref(fd, req, arg) };
         if ret < 0 {
             return Err(Error::IoctlError(req, IoError::last_os_error()));
         }
@@ -145,7 +146,8 @@ impl Tap {
     /// The caller should ensure to pass a valid file descriptor and valid
     /// arguments for the `ioctl()` syscall.
     unsafe fn ioctl_with_ref<F: AsRawFd, T>(fd: &F, req: c_ulong, arg: &T) -> Result<()> {
-        let ret = ioctl_with_ref(fd, req, arg);
+        // SAFETY: file descriptor is valid and return value is checked
+        let ret = unsafe { ioctl_with_ref(fd, req, arg) };
         if ret < 0 {
             return Err(Error::IoctlError(req, IoError::last_os_error()));
         }
@@ -157,7 +159,8 @@ impl Tap {
     /// The caller should ensure to pass a valid file descriptor and valid
     /// arguments for the `ioctl()` syscall.
     unsafe fn ioctl_with_val<F: AsRawFd>(fd: &F, req: c_ulong, arg: c_ulong) -> Result<()> {
-        let ret = ioctl_with_val(fd, req, arg);
+        // SAFETY: file descriptor is valid and return value is checked
+        let ret = unsafe { ioctl_with_val(fd, req, arg) };
         if ret < 0 {
             return Err(Error::IoctlError(req, IoError::last_os_error()));
         }
diff --git a/option_parser/Cargo.toml b/option_parser/Cargo.toml
index 2b6d0fe11..abacf51dd 100644
--- a/option_parser/Cargo.toml
+++ b/option_parser/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 authors = ["The Cloud Hypervisor Authors"]
-edition = "2021"
+edition.workspace = true
 name = "option_parser"
 version = "0.1.0"
 
diff --git a/pci/Cargo.toml b/pci/Cargo.toml
index 49618b194..e1d631c34 100644
--- a/pci/Cargo.toml
+++ b/pci/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 authors = ["Samuel Ortiz <sameo@linux.intel.com>"]
-edition = "2021"
+edition.workspace = true
 name = "pci"
 version = "0.1.0"
 
diff --git a/pci/src/vfio.rs b/pci/src/vfio.rs
index 660f27bd4..42048b8f5 100644
--- a/pci/src/vfio.rs
+++ b/pci/src/vfio.rs
@@ -190,7 +190,7 @@ pub(crate) struct Interrupt {
 
 impl Interrupt {
     fn update_msi(&mut self, offset: u64, data: &[u8]) -> Option<InterruptUpdateAction> {
-        if let Some(ref mut msi) = &mut self.msi {
+        if let Some(msi) = &mut self.msi {
             let action = msi.update(offset, data);
             return action;
         }
@@ -199,7 +199,7 @@ impl Interrupt {
     }
 
     fn update_msix(&mut self, offset: u64, data: &[u8]) -> Option<InterruptUpdateAction> {
-        if let Some(ref mut msix) = &mut self.msix {
+        if let Some(msix) = &mut self.msix {
             let action = msix.update(offset, data);
             return action;
         }
@@ -237,7 +237,7 @@ impl Interrupt {
     }
 
     fn msix_write_table(&mut self, offset: u64, data: &[u8]) {
-        if let Some(ref mut msix) = &mut self.msix {
+        if let Some(msix) = &mut self.msix {
             let offset = offset - u64::from(msix.cap.table_offset());
             msix.bar.write_table(offset, data)
         }
diff --git a/performance-metrics/Cargo.toml b/performance-metrics/Cargo.toml
index 240391376..00e6e7468 100644
--- a/performance-metrics/Cargo.toml
+++ b/performance-metrics/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 authors = ["The Cloud Hypervisor Authors"]
 build = "../build.rs"
-edition = "2021"
+edition.workspace = true
 name = "performance-metrics"
 version = "0.1.0"
 
diff --git a/rate_limiter/Cargo.toml b/rate_limiter/Cargo.toml
index 6c6cdd650..3067c695b 100644
--- a/rate_limiter/Cargo.toml
+++ b/rate_limiter/Cargo.toml
@@ -1,5 +1,5 @@
 [package]
-edition = "2021"
+edition.workspace = true
 name = "rate_limiter"
 version = "0.1.0"
 
diff --git a/serial_buffer/Cargo.toml b/serial_buffer/Cargo.toml
index 2c3993cff..0691b8a3b 100644
--- a/serial_buffer/Cargo.toml
+++ b/serial_buffer/Cargo.toml
@@ -1,5 +1,5 @@
 [package]
 authors = ["The Cloud Hypervisor Authors"]
-edition = "2021"
+edition.workspace = true
 name = "serial_buffer"
 version = "0.1.0"
diff --git a/test_infra/Cargo.toml b/test_infra/Cargo.toml
index 37c6f3845..fe3cba8ee 100644
--- a/test_infra/Cargo.toml
+++ b/test_infra/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 authors = ["The Cloud Hypervisor Authors"]
-edition = "2021"
+edition.workspace = true
 name = "test_infra"
 version = "0.1.0"
 
diff --git a/tracer/Cargo.toml b/tracer/Cargo.toml
index 368520870..bdcf55969 100644
--- a/tracer/Cargo.toml
+++ b/tracer/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 authors = ["The Cloud Hypervisor Authors"]
-edition = "2021"
+edition.workspace = true
 name = "tracer"
 version = "0.1.0"
 
diff --git a/vhost_user_block/Cargo.toml b/vhost_user_block/Cargo.toml
index ea1acf12a..c2e738566 100644
--- a/vhost_user_block/Cargo.toml
+++ b/vhost_user_block/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 authors = ["The Cloud Hypervisor Authors"]
 build = "../build.rs"
-edition = "2021"
+edition.workspace = true
 name = "vhost_user_block"
 version = "0.1.0"
 
diff --git a/vhost_user_net/Cargo.toml b/vhost_user_net/Cargo.toml
index f84eae8d1..6cd316e9f 100644
--- a/vhost_user_net/Cargo.toml
+++ b/vhost_user_net/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 authors = ["The Cloud Hypervisor Authors"]
 build = "../build.rs"
-edition = "2021"
+edition.workspace = true
 name = "vhost_user_net"
 version = "0.1.0"
 
diff --git a/virtio-devices/Cargo.toml b/virtio-devices/Cargo.toml
index e13e98f75..64a60910c 100644
--- a/virtio-devices/Cargo.toml
+++ b/virtio-devices/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 authors = ["The Cloud Hypervisor Authors"]
-edition = "2021"
+edition.workspace = true
 name = "virtio-devices"
 version = "0.1.0"
 
diff --git a/virtio-devices/src/iommu.rs b/virtio-devices/src/iommu.rs
index cdf9e5908..df310823a 100644
--- a/virtio-devices/src/iommu.rs
+++ b/virtio-devices/src/iommu.rs
@@ -489,7 +489,7 @@ impl Request {
                         .write()
                         .unwrap()
                         .iter()
-                        .filter(|(_, &d)| d == domain_id)
+                        .filter(|&(_, &d)| d == domain_id)
                         .map(|(&e, _)| e)
                         .collect();
 
@@ -553,7 +553,7 @@ impl Request {
                         .write()
                         .unwrap()
                         .iter()
-                        .filter(|(_, &d)| d == domain_id)
+                        .filter(|&(_, &d)| d == domain_id)
                         .map(|(&e, _)| e)
                         .collect();
 
@@ -669,7 +669,7 @@ fn detach_endpoint_from_domain(
         .write()
         .unwrap()
         .iter()
-        .filter(|(_, &d)| d == domain_id)
+        .filter(|&(_, &d)| d == domain_id)
         .count()
         == 0
     {
diff --git a/vm-allocator/Cargo.toml b/vm-allocator/Cargo.toml
index 4f546058e..e77e87791 100644
--- a/vm-allocator/Cargo.toml
+++ b/vm-allocator/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 authors = ["The Chromium OS Authors"]
-edition = "2021"
+edition.workspace = true
 name = "vm-allocator"
 version = "0.1.0"
 
diff --git a/vm-device/Cargo.toml b/vm-device/Cargo.toml
index ca1d38807..80ed1489a 100644
--- a/vm-device/Cargo.toml
+++ b/vm-device/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 authors = ["The Cloud Hypervisor Authors"]
-edition = "2021"
+edition.workspace = true
 name = "vm-device"
 version = "0.1.0"
 
diff --git a/vm-migration/Cargo.toml b/vm-migration/Cargo.toml
index de10ebdb3..7a8c9337b 100644
--- a/vm-migration/Cargo.toml
+++ b/vm-migration/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 authors = ["The Cloud Hypervisor Authors"]
-edition = "2021"
+edition.workspace = true
 name = "vm-migration"
 version = "0.1.0"
 
diff --git a/vm-virtio/Cargo.toml b/vm-virtio/Cargo.toml
index b22a2f555..5f195af49 100644
--- a/vm-virtio/Cargo.toml
+++ b/vm-virtio/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 authors = ["The Cloud Hypervisor Authors"]
-edition = "2021"
+edition.workspace = true
 name = "vm-virtio"
 version = "0.1.0"
 
diff --git a/vmm/Cargo.toml b/vmm/Cargo.toml
index 7793357e2..b931193a1 100644
--- a/vmm/Cargo.toml
+++ b/vmm/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 authors = ["The Cloud Hypervisor Authors"]
-edition = "2021"
+edition.workspace = true
 name = "vmm"
 version = "0.1.0"
 
diff --git a/vmm/src/clone3.rs b/vmm/src/clone3.rs
index 0ab08126e..fc273680f 100644
--- a/vmm/src/clone3.rs
+++ b/vmm/src/clone3.rs
@@ -33,5 +33,6 @@ pub struct clone_args {
 /// - On error: `-1` and `errno` is set
 #[must_use]
 pub unsafe fn clone3(args: &mut clone_args, size: size_t) -> c_long {
-    syscall(SYS_clone3, args, size)
+    // SAFETY: parameters are assumed to be valid
+    unsafe { syscall(SYS_clone3, args, size) }
 }
diff --git a/vmm/src/device_manager.rs b/vmm/src/device_manager.rs
index 0ad2ab7ca..256047e87 100644
--- a/vmm/src/device_manager.rs
+++ b/vmm/src/device_manager.rs
@@ -3373,7 +3373,7 @@ impl DeviceManager {
         let mut devices = Vec::new();
 
         let mut vsock = self.config.lock().unwrap().vsock.clone();
-        if let Some(ref mut vsock_cfg) = &mut vsock {
+        if let Some(vsock_cfg) = &mut vsock {
             devices.push(self.make_virtio_vsock_device(vsock_cfg)?);
         }
         self.config.lock().unwrap().vsock = vsock;
diff --git a/vmm/src/sigwinch_listener.rs b/vmm/src/sigwinch_listener.rs
index 4d7aebdca..104a680a6 100644
--- a/vmm/src/sigwinch_listener.rs
+++ b/vmm/src/sigwinch_listener.rs
@@ -83,7 +83,8 @@ unsafe fn close_fds_fallback(keep_fds: &BTreeSet<RawFd>) {
         .collect();
 
     for fd in open_fds.difference(keep_fds) {
-        close(*fd);
+        // SAFETY: The FD is valid
+        unsafe { close(*fd) };
     }
 }
 
@@ -108,12 +109,14 @@ unsafe fn close_unused_fds(keep_fds: &mut [RawFd]) {
             continue;
         }
 
-        if syscall(SYS_close_range, first, last, 0) == -1 {
+        // SAFETY: FDs are valid
+        if unsafe { syscall(SYS_close_range, first, last, 0) } == -1 {
             // The kernel might be too old to have close_range, in
             // which case we need to fall back to an uglier method.
             let e = io::Error::last_os_error();
             if e.raw_os_error() == Some(ENOSYS) {
-                return close_fds_fallback(&keep_fds.iter().copied().collect());
+                // SAFETY: FDs are valid
+                return unsafe { close_fds_fallback(&keep_fds.iter().copied().collect()) };
             }
 
             panic!("close_range: {e}");
@@ -212,7 +215,8 @@ unsafe fn clone_clear_sighand() -> io::Result<u64> {
         ..Default::default()
     };
     args.flags |= CLONE_CLEAR_SIGHAND;
-    let r = clone3(&mut args, size_of::<clone_args>());
+    // SAFETY: parameters are assumed to be valid
+    let r = unsafe { clone3(&mut args, size_of::<clone_args>()) };
     if r != -1 {
         return Ok(r.try_into().unwrap());
     }
@@ -223,13 +227,15 @@ unsafe fn clone_clear_sighand() -> io::Result<u64> {
 
     // If CLONE_CLEAR_SIGHAND isn't available, fall back to resetting
     // all the signal handlers one by one.
-    let r = fork();
+    // SAFETY: trivially safe, and we check the return value.
+    let r = unsafe { fork() };
     if r == -1 {
         return Err(io::Error::last_os_error());
     }
     if r == 0 {
         for signum in 1.._NSIG {
-            let _ = signal(signum, SIG_DFL);
+            // SAFETY: trivially safe, we unset the user-space signal handler
+            let _ = unsafe { signal(signum, SIG_DFL) };
         }
     }
     Ok(r.try_into().unwrap())