diff --git a/embassy-rp/src/lib.rs b/embassy-rp/src/lib.rs
index 7ac18c1f8..f56cfba27 100644
--- a/embassy-rp/src/lib.rs
+++ b/embassy-rp/src/lib.rs
@@ -480,7 +480,7 @@ pub fn install_core0_stack_guard() -> Result<(), ()> {
 
 #[cfg(all(feature = "rp2040", not(feature = "_test")))]
 #[inline(always)]
-fn install_stack_guard(stack_bottom: *mut usize) -> Result<(), ()> {
+unsafe fn install_stack_guard(stack_bottom: *mut usize) -> Result<(), ()> {
     let core = unsafe { cortex_m::Peripherals::steal() };
 
     // Fail if MPU is already configured
@@ -508,7 +508,7 @@ fn install_stack_guard(stack_bottom: *mut usize) -> Result<(), ()> {
 
 #[cfg(all(feature = "_rp235x", not(feature = "_test")))]
 #[inline(always)]
-fn install_stack_guard(stack_bottom: *mut usize) -> Result<(), ()> {
+unsafe fn install_stack_guard(stack_bottom: *mut usize) -> Result<(), ()> {
     let core = unsafe { cortex_m::Peripherals::steal() };
 
     // Fail if MPU is already configured
@@ -528,7 +528,7 @@ fn install_stack_guard(stack_bottom: *mut usize) -> Result<(), ()> {
 // so the compile fails when we try to use ARMv8 peripherals.
 #[cfg(feature = "_test")]
 #[inline(always)]
-fn install_stack_guard(_stack_bottom: *mut usize) -> Result<(), ()> {
+unsafe fn install_stack_guard(_stack_bottom: *mut usize) -> Result<(), ()> {
     Ok(())
 }
 
diff --git a/embassy-rp/src/multicore.rs b/embassy-rp/src/multicore.rs
index 81de84907..ea0a29a36 100644
--- a/embassy-rp/src/multicore.rs
+++ b/embassy-rp/src/multicore.rs
@@ -58,7 +58,7 @@ const RESUME_TOKEN: u32 = !0xDEADBEEF;
 static IS_CORE1_INIT: AtomicBool = AtomicBool::new(false);
 
 #[inline(always)]
-fn core1_setup(stack_bottom: *mut usize) {
+unsafe fn core1_setup(stack_bottom: *mut usize) {
     if install_stack_guard(stack_bottom).is_err() {
         // currently only happens if the MPU was already set up, which
         // would indicate that the core is already in use from outside
@@ -148,7 +148,7 @@ where
         entry: *mut ManuallyDrop<F>,
         stack_bottom: *mut usize,
     ) -> ! {
-        core1_setup(stack_bottom);
+        unsafe { core1_setup(stack_bottom) };
 
         let entry = unsafe { ManuallyDrop::take(&mut *entry) };
 
diff --git a/embassy-stm32-wpan/src/lib.rs b/embassy-stm32-wpan/src/lib.rs
index f9560d235..fb34d4ba0 100644
--- a/embassy-stm32-wpan/src/lib.rs
+++ b/embassy-stm32-wpan/src/lib.rs
@@ -2,6 +2,7 @@
 #![allow(async_fn_in_trait)]
 #![doc = include_str!("../README.md")]
 // #![warn(missing_docs)]
+#![allow(static_mut_refs)] // TODO: Fix
 
 // This must go FIRST so that all the other modules see its macros.
 mod fmt;
diff --git a/embassy-stm32-wpan/src/mac/commands.rs b/embassy-stm32-wpan/src/mac/commands.rs
index c97c609c3..82b9d2772 100644
--- a/embassy-stm32-wpan/src/mac/commands.rs
+++ b/embassy-stm32-wpan/src/mac/commands.rs
@@ -371,7 +371,7 @@ pub struct DataRequest {
 }
 
 impl DataRequest {
-    pub fn set_buffer<'a>(&'a mut self, buf: &'a [u8]) -> &mut Self {
+    pub fn set_buffer<'a>(&'a mut self, buf: &'a [u8]) -> &'a mut Self {
         self.msdu_ptr = buf as *const _ as *const u8;
         self.msdu_length = buf.len() as u8;
 
diff --git a/embassy-stm32/src/low_power.rs b/embassy-stm32/src/low_power.rs
index f3e4c6994..2be1a42b7 100644
--- a/embassy-stm32/src/low_power.rs
+++ b/embassy-stm32/src/low_power.rs
@@ -51,6 +51,9 @@
 //! }
 //! ```
 
+// TODO: Usage of `static mut` here is unsound. Fix then remove this `allow`.`
+#![allow(static_mut_refs)]
+
 use core::arch::asm;
 use core::marker::PhantomData;
 use core::sync::atomic::{compiler_fence, Ordering};
diff --git a/embassy-stm32/src/rcc/mod.rs b/embassy-stm32/src/rcc/mod.rs
index 8022a35a4..4f43d3748 100644
--- a/embassy-stm32/src/rcc/mod.rs
+++ b/embassy-stm32/src/rcc/mod.rs
@@ -86,7 +86,7 @@ pub(crate) unsafe fn set_freqs(freqs: Clocks) {
 #[cfg(not(feature = "_dual-core"))]
 /// Safety: Reads a mutable global.
 pub(crate) unsafe fn get_freqs() -> &'static Clocks {
-    CLOCK_FREQS.assume_init_ref()
+    (*core::ptr::addr_of_mut!(CLOCK_FREQS)).assume_init_ref()
 }
 
 #[cfg(feature = "_dual-core")]
@@ -171,7 +171,9 @@ impl RccInfo {
             // Use .get_mut instead of []-operator so that we control how bounds checks happen.
             // Otherwise, core::fmt will be pulled in here in order to format the integer in the
             // out-of-bounds error.
-            if let Some(refcount) = unsafe { crate::_generated::REFCOUNTS.get_mut(refcount_idx) } {
+            if let Some(refcount) =
+                unsafe { (*core::ptr::addr_of_mut!(crate::_generated::REFCOUNTS)).get_mut(refcount_idx) }
+            {
                 *refcount += 1;
                 if *refcount > 1 {
                     return;
@@ -235,7 +237,9 @@ impl RccInfo {
             // Use .get_mut instead of []-operator so that we control how bounds checks happen.
             // Otherwise, core::fmt will be pulled in here in order to format the integer in the
             // out-of-bounds error.
-            if let Some(refcount) = unsafe { crate::_generated::REFCOUNTS.get_mut(refcount_idx) } {
+            if let Some(refcount) =
+                unsafe { (*core::ptr::addr_of_mut!(crate::_generated::REFCOUNTS)).get_mut(refcount_idx) }
+            {
                 *refcount -= 1;
                 if *refcount > 0 {
                     return;
diff --git a/examples/stm32h7/src/bin/sai.rs b/examples/stm32h7/src/bin/sai.rs
index f6735e235..04d14bd6b 100644
--- a/examples/stm32h7/src/bin/sai.rs
+++ b/examples/stm32h7/src/bin/sai.rs
@@ -81,8 +81,9 @@ async fn main(_spawner: Spawner) {
     rx_config.sync_output = false;
 
     let tx_buffer: &mut [u32] = unsafe {
-        TX_BUFFER.initialize_all_copied(0);
-        let (ptr, len) = TX_BUFFER.get_ptr_len();
+        let buf = &mut *core::ptr::addr_of_mut!(TX_BUFFER);
+        buf.initialize_all_copied(0);
+        let (ptr, len) = buf.get_ptr_len();
         core::slice::from_raw_parts_mut(ptr, len)
     };
 
@@ -98,8 +99,9 @@ async fn main(_spawner: Spawner) {
     );
 
     let rx_buffer: &mut [u32] = unsafe {
-        RX_BUFFER.initialize_all_copied(0);
-        let (ptr, len) = RX_BUFFER.get_ptr_len();
+        let buf = &mut *core::ptr::addr_of_mut!(RX_BUFFER);
+        buf.initialize_all_copied(0);
+        let (ptr, len) = buf.get_ptr_len();
         core::slice::from_raw_parts_mut(ptr, len)
     };
 
diff --git a/examples/stm32h7/src/bin/spi_bdma.rs b/examples/stm32h7/src/bin/spi_bdma.rs
index 43fb6b41c..9166fe9b6 100644
--- a/examples/stm32h7/src/bin/spi_bdma.rs
+++ b/examples/stm32h7/src/bin/spi_bdma.rs
@@ -22,10 +22,11 @@ static mut RAM_D3: GroundedArrayCell<u8, 256> = GroundedArrayCell::uninit();
 #[embassy_executor::task]
 async fn main_task(mut spi: spi::Spi<'static, Async>) {
     let (read_buffer, write_buffer) = unsafe {
-        RAM_D3.initialize_all_copied(0);
+        let ram = &mut *core::ptr::addr_of_mut!(RAM_D3);
+        ram.initialize_all_copied(0);
         (
-            RAM_D3.get_subslice_mut_unchecked(0, 128),
-            RAM_D3.get_subslice_mut_unchecked(128, 128),
+            ram.get_subslice_mut_unchecked(0, 128),
+            ram.get_subslice_mut_unchecked(128, 128),
         )
     };
 
diff --git a/rust-toolchain-nightly.toml b/rust-toolchain-nightly.toml
index 0b10d7194..acab9d615 100644
--- a/rust-toolchain-nightly.toml
+++ b/rust-toolchain-nightly.toml
@@ -1,5 +1,5 @@
 [toolchain]
-channel = "nightly-2024-09-06"
+channel = "nightly-2024-10-13"
 components = [ "rust-src", "rustfmt", "llvm-tools", "miri" ]
 targets = [
     "thumbv7em-none-eabi",
diff --git a/tests/nrf/src/bin/buffered_uart_spam.rs b/tests/nrf/src/bin/buffered_uart_spam.rs
index e8fca452e..843313537 100644
--- a/tests/nrf/src/bin/buffered_uart_spam.rs
+++ b/tests/nrf/src/bin/buffered_uart_spam.rs
@@ -55,7 +55,7 @@ async fn main(_spawner: Spawner) {
     let task = unsafe { Task::new_unchecked(NonNull::new_unchecked(&spam_peri.tasks_starttx as *const _ as _)) };
     let mut spam_ppi = Ppi::new_one_to_one(p.PPI_CH2, event, task);
     spam_ppi.enable();
-    let p = unsafe { TX_BUF.as_mut_ptr() };
+    let p = unsafe { core::ptr::addr_of_mut!(TX_BUF) } as *mut u8;
     spam_peri.txd.ptr.write(|w| unsafe { w.ptr().bits(p as u32) });
     spam_peri.txd.maxcnt.write(|w| unsafe { w.maxcnt().bits(NSPAM as _) });
     spam_peri.tasks_starttx.write(|w| unsafe { w.bits(1) });
diff --git a/tests/stm32/src/bin/usart_rx_ringbuffered.rs b/tests/stm32/src/bin/usart_rx_ringbuffered.rs
index 98c7ef312..83c0887ac 100644
--- a/tests/stm32/src/bin/usart_rx_ringbuffered.rs
+++ b/tests/stm32/src/bin/usart_rx_ringbuffered.rs
@@ -43,8 +43,7 @@ async fn main(spawner: Spawner) {
     let usart = Uart::new(usart, rx, tx, irq, tx_dma, rx_dma, config).unwrap();
     let (tx, rx) = usart.split();
     static mut DMA_BUF: [u8; DMA_BUF_SIZE] = [0; DMA_BUF_SIZE];
-    let dma_buf = unsafe { DMA_BUF.as_mut() };
-    let rx = rx.into_ring_buffered(dma_buf);
+    let rx = rx.into_ring_buffered(unsafe { &mut *core::ptr::addr_of_mut!(DMA_BUF) });
 
     info!("Spawning tasks");
     spawner.spawn(transmit_task(tx)).unwrap();