diff --git a/library/panic_unwind/src/seh.rs b/library/panic_unwind/src/seh.rs
index c4f4d2fbec915..e63749c77cef3 100644
--- a/library/panic_unwind/src/seh.rs
+++ b/library/panic_unwind/src/seh.rs
@@ -49,7 +49,7 @@
 use alloc::boxed::Box;
 use core::any::Any;
 use core::mem::{self, ManuallyDrop};
-use core::ptr;
+use core::ptr::{addr_of, addr_of_mut};
 use libc::{c_int, c_uint, c_void};
 
 // NOTE(nbdd0121): The `canary` field is part of stable ABI.
@@ -135,7 +135,7 @@ mod imp {
     macro_rules! ptr {
         (0) => (0);
         ($e:expr) => {
-            (($e as usize) - (&imp::__ImageBase as *const _ as usize)) as u32
+            (($e as usize) - (addr_of!(imp::__ImageBase) as usize)) as u32
         }
     }
 }
@@ -220,7 +220,7 @@ extern "C" {
 // This is fine since the MSVC runtime uses string comparison on the type name
 // to match TypeDescriptors rather than pointer equality.
 static mut TYPE_DESCRIPTOR: _TypeDescriptor = _TypeDescriptor {
-    pVFTable: unsafe { &TYPE_INFO_VTABLE } as *const _ as *const _,
+    pVFTable: unsafe { addr_of!(TYPE_INFO_VTABLE) } as *const _,
     spare: core::ptr::null_mut(),
     name: TYPE_NAME,
 };
@@ -261,9 +261,6 @@ cfg_if::cfg_if! {
    }
 }
 
-// FIXME: Use `SyncUnsafeCell` instead of allowing `static_mut_refs` lint
-#[cfg_attr(bootstrap, allow(static_mut_ref))]
-#[cfg_attr(not(bootstrap), allow(static_mut_refs))]
 pub unsafe fn panic(data: Box<dyn Any + Send>) -> u32 {
     use core::intrinsics::atomic_store_seqcst;
 
@@ -274,8 +271,9 @@ pub unsafe fn panic(data: Box<dyn Any + Send>) -> u32 {
     // The ManuallyDrop is needed here since we don't want Exception to be
     // dropped when unwinding. Instead it will be dropped by exception_cleanup
     // which is invoked by the C++ runtime.
-    let mut exception = ManuallyDrop::new(Exception { canary: &TYPE_DESCRIPTOR, data: Some(data) });
-    let throw_ptr = &mut exception as *mut _ as *mut _;
+    let mut exception =
+        ManuallyDrop::new(Exception { canary: addr_of!(TYPE_DESCRIPTOR), data: Some(data) });
+    let throw_ptr = addr_of_mut!(exception) as *mut _;
 
     // This... may seems surprising, and justifiably so. On 32-bit MSVC the
     // pointers between these structure are just that, pointers. On 64-bit MSVC,
@@ -298,23 +296,23 @@ pub unsafe fn panic(data: Box<dyn Any + Send>) -> u32 {
     // In any case, we basically need to do something like this until we can
     // express more operations in statics (and we may never be able to).
     atomic_store_seqcst(
-        &mut THROW_INFO.pmfnUnwind as *mut _ as *mut u32,
+        addr_of_mut!(THROW_INFO.pmfnUnwind) as *mut u32,
         ptr!(exception_cleanup) as u32,
     );
     atomic_store_seqcst(
-        &mut THROW_INFO.pCatchableTypeArray as *mut _ as *mut u32,
-        ptr!(&CATCHABLE_TYPE_ARRAY as *const _) as u32,
+        addr_of_mut!(THROW_INFO.pCatchableTypeArray) as *mut u32,
+        ptr!(addr_of!(CATCHABLE_TYPE_ARRAY)) as u32,
     );
     atomic_store_seqcst(
-        &mut CATCHABLE_TYPE_ARRAY.arrayOfCatchableTypes[0] as *mut _ as *mut u32,
-        ptr!(&CATCHABLE_TYPE as *const _) as u32,
+        addr_of_mut!(CATCHABLE_TYPE_ARRAY.arrayOfCatchableTypes[0]) as *mut u32,
+        ptr!(addr_of!(CATCHABLE_TYPE)) as u32,
     );
     atomic_store_seqcst(
-        &mut CATCHABLE_TYPE.pType as *mut _ as *mut u32,
-        ptr!(&TYPE_DESCRIPTOR as *const _) as u32,
+        addr_of_mut!(CATCHABLE_TYPE.pType) as *mut u32,
+        ptr!(addr_of!(TYPE_DESCRIPTOR)) as u32,
     );
     atomic_store_seqcst(
-        &mut CATCHABLE_TYPE.copyFunction as *mut _ as *mut u32,
+        addr_of_mut!(CATCHABLE_TYPE.copyFunction) as *mut u32,
         ptr!(exception_copy) as u32,
     );
 
@@ -322,12 +320,9 @@ pub unsafe fn panic(data: Box<dyn Any + Send>) -> u32 {
         fn _CxxThrowException(pExceptionObject: *mut c_void, pThrowInfo: *mut u8) -> !;
     }
 
-    _CxxThrowException(throw_ptr, &mut THROW_INFO as *mut _ as *mut _);
+    _CxxThrowException(throw_ptr, addr_of_mut!(THROW_INFO) as *mut _);
 }
 
-// FIXME: Use `SyncUnsafeCell` instead of allowing `static_mut_refs` lint
-#[cfg_attr(bootstrap, allow(static_mut_ref))]
-#[cfg_attr(not(bootstrap), allow(static_mut_refs))]
 pub unsafe fn cleanup(payload: *mut u8) -> Box<dyn Any + Send> {
     // A null payload here means that we got here from the catch (...) of
     // __rust_try. This happens when a non-Rust foreign exception is caught.
@@ -335,8 +330,8 @@ pub unsafe fn cleanup(payload: *mut u8) -> Box<dyn Any + Send> {
         super::__rust_foreign_exception();
     }
     let exception = payload as *mut Exception;
-    let canary = ptr::addr_of!((*exception).canary).read();
-    if !ptr::eq(canary, &TYPE_DESCRIPTOR) {
+    let canary = addr_of!((*exception).canary).read();
+    if !core::ptr::eq(canary, addr_of!(TYPE_DESCRIPTOR)) {
         // A foreign Rust exception.
         super::__rust_foreign_exception();
     }
diff --git a/library/std/src/panicking.rs b/library/std/src/panicking.rs
index c8306c1b597a3..66b4ec37c8ec5 100644
--- a/library/std/src/panicking.rs
+++ b/library/std/src/panicking.rs
@@ -337,9 +337,6 @@ pub mod panic_count {
 #[doc(hidden)]
 #[cfg(not(feature = "panic_immediate_abort"))]
 #[unstable(feature = "update_panic_count", issue = "none")]
-// FIXME: Use `SyncUnsafeCell` instead of allowing `static_mut_refs` lint
-#[cfg_attr(bootstrap, allow(static_mut_ref))]
-#[cfg_attr(not(bootstrap), allow(static_mut_refs))]
 pub mod panic_count {
     use crate::cell::Cell;
     use crate::sync::atomic::{AtomicUsize, Ordering};
diff --git a/library/std/src/thread/local.rs b/library/std/src/thread/local.rs
index 34d30a259ee98..fbb882e640b64 100644
--- a/library/std/src/thread/local.rs
+++ b/library/std/src/thread/local.rs
@@ -180,8 +180,6 @@ impl<T: 'static> fmt::Debug for LocalKey<T> {
 #[stable(feature = "rust1", since = "1.0.0")]
 #[cfg_attr(not(test), rustc_diagnostic_item = "thread_local_macro")]
 #[allow_internal_unstable(thread_local_internals)]
-// FIXME: Use `SyncUnsafeCell` instead of allowing `static_mut_refs` lint
-#[cfg_attr(not(bootstrap), allow(static_mut_refs))]
 macro_rules! thread_local {
     // empty (base case for the recursion)
     () => {};
diff --git a/src/tools/miri/tests/fail/tls/tls_static_dealloc.rs b/src/tools/miri/tests/fail/tls/tls_static_dealloc.rs
index d47a05d8475cf..c72cc8114dac4 100644
--- a/src/tools/miri/tests/fail/tls/tls_static_dealloc.rs
+++ b/src/tools/miri/tests/fail/tls/tls_static_dealloc.rs
@@ -1,8 +1,8 @@
 //! Ensure that thread-local statics get deallocated when the thread dies.
 
 #![feature(thread_local)]
-// FIXME: Use `SyncUnsafeCell` instead of allowing `static_mut_refs` lint
-#![allow(static_mut_refs)]
+
+use std::ptr::addr_of;
 
 #[thread_local]
 static mut TLS: u8 = 0;
@@ -12,7 +12,7 @@ unsafe impl Send for SendRaw {}
 
 fn main() {
     unsafe {
-        let dangling_ptr = std::thread::spawn(|| SendRaw(&TLS as *const u8)).join().unwrap();
+        let dangling_ptr = std::thread::spawn(|| SendRaw(addr_of!(TLS))).join().unwrap();
         let _val = *dangling_ptr.0; //~ ERROR: has been freed
     }
 }
diff --git a/src/tools/miri/tests/pass/static_mut.rs b/src/tools/miri/tests/pass/static_mut.rs
index 6b0c0297726f3..1b416cc4e9b08 100644
--- a/src/tools/miri/tests/pass/static_mut.rs
+++ b/src/tools/miri/tests/pass/static_mut.rs
@@ -1,8 +1,8 @@
+use std::ptr::addr_of;
+
 static mut FOO: i32 = 42;
 
-// FIXME: Use `SyncUnsafeCell` instead of allowing `static_mut_refs` lint
-#[allow(static_mut_refs)]
-static BAR: Foo = Foo(unsafe { &FOO as *const _ });
+static BAR: Foo = Foo(unsafe { addr_of!(FOO) });
 
 #[allow(dead_code)]
 struct Foo(*const i32);
diff --git a/src/tools/miri/tests/pass/tls/tls_static.rs b/src/tools/miri/tests/pass/tls/tls_static.rs
index fea5bb1db5e6b..8d0e5089d404a 100644
--- a/src/tools/miri/tests/pass/tls/tls_static.rs
+++ b/src/tools/miri/tests/pass/tls/tls_static.rs
@@ -8,9 +8,8 @@
 //! test, we also check that thread-locals act as per-thread statics.
 
 #![feature(thread_local)]
-// FIXME: Use `SyncUnsafeCell` instead of allowing `static_mut_refs` lint
-#![allow(static_mut_refs)]
 
+use std::ptr::addr_of_mut;
 use std::thread;
 
 #[thread_local]
@@ -23,8 +22,8 @@ static mut C: u8 = 0;
 #[thread_local]
 static READ_ONLY: u8 = 42;
 
-unsafe fn get_a_ref() -> *mut u8 {
-    &mut A
+unsafe fn get_a_ptr() -> *mut u8 {
+    addr_of_mut!(A)
 }
 
 struct Sender(*mut u8);
@@ -35,12 +34,12 @@ fn main() {
     let _val = READ_ONLY;
 
     let ptr = unsafe {
-        let x = get_a_ref();
+        let x = get_a_ptr();
         *x = 5;
         assert_eq!(A, 5);
         B = 15;
         C = 25;
-        Sender(&mut A)
+        Sender(addr_of_mut!(A))
     };
 
     thread::spawn(move || unsafe {
@@ -51,18 +50,18 @@ fn main() {
         assert_eq!(C, 25);
         B = 14;
         C = 24;
-        let y = get_a_ref();
+        let y = get_a_ptr();
         assert_eq!(*y, 0);
         *y = 4;
         assert_eq!(*ptr.0, 5);
         assert_eq!(A, 4);
-        assert_eq!(*get_a_ref(), 4);
+        assert_eq!(*get_a_ptr(), 4);
     })
     .join()
     .unwrap();
 
     unsafe {
-        assert_eq!(*get_a_ref(), 5);
+        assert_eq!(*get_a_ptr(), 5);
         assert_eq!(A, 5);
         assert_eq!(B, 15);
         assert_eq!(C, 24);