diff --git a/src/decode.rs b/src/decode.rs
index 1ed9fcff1..69b5ac1f9 100644
--- a/src/decode.rs
+++ b/src/decode.rs
@@ -4756,9 +4756,7 @@ fn rav1d_decode_frame_main(c: &Rav1dContext, f: &mut Rav1dFrameData) -> Rav1dRes
             }
 
             // loopfilter + cdef + restoration
-            //
-            // SAFETY: Function call with all safe args, will be marked safe.
-            unsafe { (f.bd_fn().filter_sbrow)(c, f, &mut t, sby) };
+            (f.bd_fn().filter_sbrow)(c, f, &mut t, sby);
         }
     }
 
diff --git a/src/recon.rs b/src/recon.rs
index 518a7fdff..24e0b20a6 100644
--- a/src/recon.rs
+++ b/src/recon.rs
@@ -1,3 +1,5 @@
+#![deny(unsafe_op_in_unsafe_fn)]
+
 use crate::include::common::bitdepth::AsPrimitive;
 use crate::include::common::bitdepth::BitDepth;
 use crate::include::common::bitdepth::BPC;
@@ -142,7 +144,7 @@ pub(crate) type recon_b_inter_fn = fn(
 ) -> Result<(), ()>;
 
 pub(crate) type filter_sbrow_fn =
-    unsafe fn(&Rav1dContext, &Rav1dFrameData, &mut Rav1dTaskContext, c_int) -> ();
+    fn(&Rav1dContext, &Rav1dFrameData, &mut Rav1dTaskContext, c_int) -> ();
 
 pub(crate) type backup_ipred_edge_fn = fn(&Rav1dFrameData, &mut Rav1dTaskContext) -> ();
 
@@ -4015,7 +4017,7 @@ pub(crate) fn rav1d_filter_sbrow_deblock_rows<BD: BitDepth>(
     }
 }
 
-pub(crate) unsafe fn rav1d_filter_sbrow_cdef<BD: BitDepth>(
+pub(crate) fn rav1d_filter_sbrow_cdef<BD: BitDepth>(
     c: &Rav1dContext,
     f: &Rav1dFrameData,
     tc: &mut Rav1dTaskContext,
@@ -4037,12 +4039,14 @@ pub(crate) unsafe fn rav1d_filter_sbrow_cdef<BD: BitDepth>(
             let ss_ver = f.cur.p.layout == Rav1dPixelLayout::I420 && i != 0;
             p[i] - ((8 * p[i].pixel_stride::<BD>()) >> ss_ver as u8)
         });
-        rav1d_cdef_brow::<BD>(c, tc, f, p_up, prev_mask, start - 2, start, true, sby);
+        // TODO make safe
+        unsafe { rav1d_cdef_brow::<BD>(c, tc, f, p_up, prev_mask, start - 2, start, true, sby) };
     }
 
     let n_blks = sbsz - 2 * ((sby + 1) < f.sbh) as c_int;
     let end = cmp::min(start + n_blks, f.bh);
-    rav1d_cdef_brow::<BD>(c, tc, f, p, mask_offset, start, end, false, sby);
+    // TODO make safe
+    unsafe { rav1d_cdef_brow::<BD>(c, tc, f, p, mask_offset, start, end, false, sby) };
 }
 
 pub(crate) fn rav1d_filter_sbrow_resize<BD: BitDepth>(
@@ -4101,7 +4105,7 @@ pub(crate) fn rav1d_filter_sbrow_lr<BD: BitDepth>(
     rav1d_lr_sbrow::<BD>(c, f, sr_p, sby);
 }
 
-pub(crate) unsafe fn rav1d_filter_sbrow<BD: BitDepth>(
+pub(crate) fn rav1d_filter_sbrow<BD: BitDepth>(
     c: &Rav1dContext,
     f: &Rav1dFrameData,
     t: &mut Rav1dTaskContext,
diff --git a/src/thread_task.rs b/src/thread_task.rs
index d90e57077..8479d4e01 100644
--- a/src/thread_task.rs
+++ b/src/thread_task.rs
@@ -1206,10 +1206,7 @@ pub fn rav1d_worker_task(task_thread: Arc<Rav1dTaskContext_task_thread>) {
                         {
                             let f = fc.data.try_read().unwrap();
                             if fc.task_thread.error.load(Ordering::SeqCst) == 0 {
-                                // SAFETY: TODO make safe
-                                unsafe {
-                                    (f.bd_fn().filter_sbrow_deblock_cols)(c, &f, &mut tc, sby);
-                                }
+                                (f.bd_fn().filter_sbrow_deblock_cols)(c, &f, &mut tc, sby);
                             }
                         }
                         if ensure_progress(
@@ -1229,10 +1226,7 @@ pub fn rav1d_worker_task(task_thread: Arc<Rav1dTaskContext_task_thread>) {
                     TaskType::DeblockRows => {
                         let f = fc.data.try_read().unwrap();
                         if fc.task_thread.error.load(Ordering::SeqCst) == 0 {
-                            // SAFETY: TODO make safe
-                            unsafe {
-                                (f.bd_fn().filter_sbrow_deblock_rows)(c, &f, &mut tc, sby);
-                            }
+                            (f.bd_fn().filter_sbrow_deblock_rows)(c, &f, &mut tc, sby);
                         }
                         // signal deblock progress
                         let seq_hdr = &***f.seq_hdr.as_ref().unwrap();
@@ -1299,10 +1293,7 @@ pub fn rav1d_worker_task(task_thread: Arc<Rav1dTaskContext_task_thread>) {
                         let frame_hdr = &***f.frame_hdr.as_ref().unwrap();
                         if frame_hdr.size.width[0] != frame_hdr.size.width[1] {
                             if fc.task_thread.error.load(Ordering::SeqCst) == 0 {
-                                // SAFETY: TODO make safe
-                                unsafe {
-                                    (f.bd_fn().filter_sbrow_resize)(c, &f, &mut tc, sby);
-                                }
+                                (f.bd_fn().filter_sbrow_resize)(c, &f, &mut tc, sby);
                             }
                         }
                         task_type = TaskType::LoopRestoration;
@@ -1313,10 +1304,7 @@ pub fn rav1d_worker_task(task_thread: Arc<Rav1dTaskContext_task_thread>) {
                         if fc.task_thread.error.load(Ordering::SeqCst) == 0
                             && f.lf.restore_planes != 0
                         {
-                            // SAFETY: TODO make safe
-                            unsafe {
-                                (f.bd_fn().filter_sbrow_lr)(c, &f, &mut tc, sby);
-                            }
+                            (f.bd_fn().filter_sbrow_lr)(c, &f, &mut tc, sby);
                         }
                         task_type = TaskType::ReconstructionProgress;
                         continue 'fallthrough;