diff --git a/src/header/regex/mod.rs b/src/header/regex/mod.rs
index 4127fa6f06..9b4c37ffaa 100644
--- a/src/header/regex/mod.rs
+++ b/src/header/regex/mod.rs
@@ -2,6 +2,9 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/regex.h.html>.
 
+// TODO: set this for entire crate when possible
+#![deny(unsafe_op_in_unsafe_fn)]
+
 use crate::{
     header::string::strlen,
     platform::types::{c_char, c_int, c_void, size_t},
@@ -55,7 +58,7 @@ pub const REG_BADRPT: c_int = 14;
 #[unsafe(no_mangle)]
 #[linkage = "weak"] // redefined in GIT
 pub unsafe extern "C" fn regcomp(out: *mut regex_t, pat: *const c_char, cflags: c_int) -> c_int {
-    let pat = slice::from_raw_parts(pat as *const u8, strlen(pat));
+    let pat = unsafe { slice::from_raw_parts(pat as *const u8, strlen(pat)) };
     let res = PosixRegexBuilder::new(pat)
         .with_default_classes()
         .extended(cflags & REG_EXTENDED == REG_EXTENDED)
@@ -64,11 +67,13 @@ pub unsafe extern "C" fn regcomp(out: *mut regex_t, pat: *const c_char, cflags:
     match res {
         Ok(mut branches) => {
             let re_nsub = PosixRegex::new(Cow::Borrowed(&branches)).count_groups();
-            *out = regex_t {
-                ptr: Box::into_raw(Box::new(branches)) as *mut c_void,
+            unsafe {
+                *out = regex_t {
+                    ptr: Box::into_raw(Box::new(branches)) as *mut c_void,
 
-                cflags,
-                re_nsub,
+                    cflags,
+                    re_nsub,
+                }
             };
             0
         }
@@ -87,7 +92,7 @@ pub unsafe extern "C" fn regcomp(out: *mut regex_t, pat: *const c_char, cflags:
 #[unsafe(no_mangle)]
 #[linkage = "weak"] // redefined in GIT
 pub unsafe extern "C" fn regfree(regex: *mut regex_t) {
-    Box::from_raw((*regex).ptr);
+    unsafe { Box::from_raw((*regex).ptr) };
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/regexec.html>.
@@ -100,14 +105,14 @@ pub unsafe extern "C" fn regexec(
     pmatch: *mut regmatch_t,
     eflags: c_int,
 ) -> c_int {
-    let regex = &*regex;
+    let regex = unsafe { &*regex };
 
     // Allow specifying a compiler argument to the executor and viceversa
     // because why not?
     let flags = regex.cflags | eflags;
 
-    let input = slice::from_raw_parts(input as *const u8, strlen(input));
-    let branches = &*(regex.ptr as *mut Tree);
+    let input = unsafe { slice::from_raw_parts(input as *const u8, strlen(input)) };
+    let branches = unsafe { &*(regex.ptr as *mut Tree) };
 
     let matches = PosixRegex::new(Cow::Borrowed(&branches))
         .case_insensitive(flags & REG_ICASE == REG_ICASE)
@@ -121,9 +126,11 @@ pub unsafe extern "C" fn regexec(
 
         for i in 0..nmatch {
             let (start, end) = first.get(i).and_then(|&range| range).unwrap_or((!0, !0));
-            *pmatch.add(i) = regmatch_t {
-                rm_so: start,
-                rm_eo: end,
+            unsafe {
+                *pmatch.add(i) = regmatch_t {
+                    rm_so: start,
+                    rm_eo: end,
+                }
             };
         }
     }