diff --git a/authfs/fd_server/src/aidl.rs b/authfs/fd_server/src/aidl.rs
index 8edd899..5f91987 100644
--- a/authfs/fd_server/src/aidl.rs
+++ b/authfs/fd_server/src/aidl.rs
@@ -289,7 +289,7 @@
             FdConfig::OutputDir(dir) => {
                 let mode = validate_file_mode(mode)?;
                 let new_fd = openat(
-                    dir.as_raw_fd(),
+                    Some(dir.as_raw_fd()),
                     basename,
                     // This function is supposed to be only called when FUSE/authfs thinks the file
                     // does not exist. However, if the file does exist from the view of fd_server
@@ -319,10 +319,14 @@
             FdConfig::InputDir(_) => Err(new_errno_error(Errno::EACCES)),
             FdConfig::OutputDir(_) => {
                 let mode = validate_file_mode(mode)?;
-                mkdirat(dir_fd, basename, mode).map_err(new_errno_error)?;
-                let new_dir_fd =
-                    openat(dir_fd, basename, OFlag::O_DIRECTORY | OFlag::O_RDONLY, Mode::empty())
-                        .map_err(new_errno_error)?;
+                mkdirat(Some(dir_fd), basename, mode).map_err(new_errno_error)?;
+                let new_dir_fd = openat(
+                    Some(dir_fd),
+                    basename,
+                    OFlag::O_DIRECTORY | OFlag::O_RDONLY,
+                    Mode::empty(),
+                )
+                .map_err(new_errno_error)?;
                 // SAFETY: new_dir_fd is just created and not an error.
                 let fd_owner = unsafe { OwnedFd::from_raw_fd(new_dir_fd) };
                 Ok((new_dir_fd, FdConfig::OutputDir(fd_owner)))
@@ -403,7 +407,7 @@
 }
 
 fn open_readonly_at(dir_fd: BorrowedFd, path: &Path) -> nix::Result<File> {
-    let new_fd = openat(dir_fd.as_raw_fd(), path, OFlag::O_RDONLY, Mode::empty())?;
+    let new_fd = openat(Some(dir_fd.as_raw_fd()), path, OFlag::O_RDONLY, Mode::empty())?;
     // SAFETY: new_fd is just created successfully and not owned.
     let new_file = unsafe { File::from_raw_fd(new_fd) };
     Ok(new_file)
diff --git a/compos/composd/src/fd_server_helper.rs b/compos/composd/src/fd_server_helper.rs
index 24371b5..91860ab 100644
--- a/compos/composd/src/fd_server_helper.rs
+++ b/compos/composd/src/fd_server_helper.rs
@@ -23,7 +23,7 @@
 use nix::unistd::pipe2;
 use std::fs::File;
 use std::io::Read;
-use std::os::unix::io::{AsRawFd, FromRawFd, OwnedFd};
+use std::os::unix::io::{AsRawFd, OwnedFd};
 use std::path::Path;
 
 const FD_SERVER_BIN: &str = "/apex/com.android.virt/bin/fd_server";
@@ -106,12 +106,8 @@
 }
 
 fn create_pipe() -> Result<(File, File)> {
-    let (raw_read, raw_write) = pipe2(OFlag::O_CLOEXEC)?;
-    // SAFETY: We are the sole owner of raw_read and it is valid as it was just created.
-    let read_fd = unsafe { File::from_raw_fd(raw_read) };
-    // SAFETY: We are the sole owner of raw_write and it is valid as it was just created.
-    let write_fd = unsafe { File::from_raw_fd(raw_write) };
-    Ok((read_fd, write_fd))
+    let (read_fd, write_fd) = pipe2(OFlag::O_CLOEXEC)?;
+    Ok((read_fd.into(), write_fd.into()))
 }
 
 fn wait_for_fd_server_ready(mut ready_fd: File) -> Result<()> {
diff --git a/service_vm/manager/src/lib.rs b/service_vm/manager/src/lib.rs
index 273b54d..987325d 100644
--- a/service_vm/manager/src/lib.rs
+++ b/service_vm/manager/src/lib.rs
@@ -30,7 +30,6 @@
 use service_vm_comm::{Request, Response, ServiceVmRequest, VmType};
 use std::fs::{self, File, OpenOptions};
 use std::io::{self, BufRead, BufReader, BufWriter, Read, Write};
-use std::os::unix::io::FromRawFd;
 use std::path::{Path, PathBuf};
 use std::sync::{Condvar, Mutex};
 use std::thread;
@@ -294,10 +293,8 @@
 pub fn android_log_fd() -> io::Result<File> {
     let (reader_fd, writer_fd) = nix::unistd::pipe()?;
 
-    // SAFETY: These are new FDs with no previous owner.
-    let reader = unsafe { File::from_raw_fd(reader_fd) };
-    // SAFETY: These are new FDs with no previous owner.
-    let writer = unsafe { File::from_raw_fd(writer_fd) };
+    let reader = File::from(reader_fd);
+    let writer = File::from(writer_fd);
 
     thread::spawn(|| {
         for line in BufReader::new(reader).lines() {
diff --git a/virtualizationmanager/src/aidl.rs b/virtualizationmanager/src/aidl.rs
index 279b4ec..001c070 100644
--- a/virtualizationmanager/src/aidl.rs
+++ b/virtualizationmanager/src/aidl.rs
@@ -1410,13 +1410,11 @@
         return Ok(None);
     };
 
-    let (raw_read_fd, raw_write_fd) =
+    let (read_fd, write_fd) =
         pipe().context("Failed to create pipe").or_service_specific_exception(-1)?;
 
-    // SAFETY: We are the sole owner of this FD as we just created it, and it is valid and open.
-    let mut reader = BufReader::new(unsafe { File::from_raw_fd(raw_read_fd) });
-    // SAFETY: We are the sole owner of this FD as we just created it, and it is valid and open.
-    let write_fd = unsafe { File::from_raw_fd(raw_write_fd) };
+    let mut reader = BufReader::new(File::from(read_fd));
+    let write_fd = File::from(write_fd);
 
     std::thread::spawn(move || loop {
         let mut buf = vec![];
diff --git a/virtualizationmanager/src/crosvm.rs b/virtualizationmanager/src/crosvm.rs
index 86c9af3..58f54cd 100644
--- a/virtualizationmanager/src/crosvm.rs
+++ b/virtualizationmanager/src/crosvm.rs
@@ -34,7 +34,7 @@
 use std::io::{self, Read};
 use std::mem;
 use std::num::{NonZeroU16, NonZeroU32};
-use std::os::unix::io::{AsRawFd, RawFd, FromRawFd};
+use std::os::unix::io::{AsRawFd, RawFd};
 use std::os::unix::process::ExitStatusExt;
 use std::path::{Path, PathBuf};
 use std::process::{Command, ExitStatus};
@@ -1041,10 +1041,6 @@
 
 /// Creates a new pipe with the `O_CLOEXEC` flag set, and returns the read side and write side.
 fn create_pipe() -> Result<(File, File), Error> {
-    let (raw_read, raw_write) = pipe2(OFlag::O_CLOEXEC)?;
-    // SAFETY: We are the sole owner of this FD as we just created it, and it is valid and open.
-    let read_fd = unsafe { File::from_raw_fd(raw_read) };
-    // SAFETY: We are the sole owner of this FD as we just created it, and it is valid and open.
-    let write_fd = unsafe { File::from_raw_fd(raw_write) };
-    Ok((read_fd, write_fd))
+    let (read_fd, write_fd) = pipe2(OFlag::O_CLOEXEC)?;
+    Ok((read_fd.into(), write_fd.into()))
 }
diff --git a/vmbase/example/tests/test.rs b/vmbase/example/tests/test.rs
index 2df5a80..4dc6aec 100644
--- a/vmbase/example/tests/test.rs
+++ b/vmbase/example/tests/test.rs
@@ -27,7 +27,6 @@
     collections::{HashSet, VecDeque},
     fs::File,
     io::{self, BufRead, BufReader, Read, Write},
-    os::unix::io::FromRawFd,
     panic, thread,
 };
 use vmclient::{DeathReason, VmInstance};
@@ -142,13 +141,7 @@
 
 fn pipe() -> io::Result<(File, File)> {
     let (reader_fd, writer_fd) = nix::unistd::pipe()?;
-
-    // SAFETY: These are new FDs with no previous owner.
-    let reader = unsafe { File::from_raw_fd(reader_fd) };
-    // SAFETY: These are new FDs with no previous owner.
-    let writer = unsafe { File::from_raw_fd(writer_fd) };
-
-    Ok((reader, writer))
+    Ok((reader_fd.into(), writer_fd.into()))
 }
 
 struct VmLogProcessor {
diff --git a/vmclient/src/lib.rs b/vmclient/src/lib.rs
index a2a88d8..88072a7 100644
--- a/vmclient/src/lib.rs
+++ b/vmclient/src/lib.rs
@@ -48,7 +48,7 @@
 use std::{
     fmt::{self, Debug, Formatter},
     fs::File,
-    os::unix::io::{AsFd, AsRawFd, FromRawFd, IntoRawFd, OwnedFd},
+    os::unix::io::{AsFd, AsRawFd, IntoRawFd, OwnedFd},
     sync::Arc,
     time::Duration,
 };
@@ -62,10 +62,7 @@
 
     // Create new POSIX pipe. Make it O_CLOEXEC to align with how Rust creates
     // file descriptors (expected by SharedChild).
-    let (raw1, raw2) = pipe2(OFlag::O_CLOEXEC)?;
-
-    // SAFETY: Taking ownership of brand new FDs.
-    unsafe { Ok((OwnedFd::from_raw_fd(raw1), OwnedFd::from_raw_fd(raw2))) }
+    Ok(pipe2(OFlag::O_CLOEXEC)?)
 }
 
 fn posix_socketpair() -> Result<(OwnedFd, OwnedFd), io::Error> {