diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index e12c5060d79..42b483c8095 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -11,7 +11,7 @@
 # allowlisted using a toolchain that requires it, causing the A/B-test to
 # always fail.
 [toolchain]
-channel = "1.87.0"
+channel = "1.89.0"
 targets = ["x86_64-unknown-linux-musl", "aarch64-unknown-linux-musl"]
 profile = "minimal"
 
diff --git a/src/firecracker/src/api_server/mod.rs b/src/firecracker/src/api_server/mod.rs
index 71d1856b0d5..60daaa26639 100644
--- a/src/firecracker/src/api_server/mod.rs
+++ b/src/firecracker/src/api_server/mod.rs
@@ -174,12 +174,12 @@ impl ApiServer {
         let vmm_outcome = *(self.vmm_response_receiver.recv().expect("VMM disconnected"));
         let response = ParsedRequest::convert_to_response(&vmm_outcome);
 
-        if vmm_outcome.is_ok() {
-            if let Some((metric, action)) = metric_with_action {
-                let elapsed_time_us =
-                    update_metric_with_elapsed_time(metric, request_processing_start_us);
-                info!("'{}' API request took {} us.", action, elapsed_time_us);
-            }
+        if vmm_outcome.is_ok()
+            && let Some((metric, action)) = metric_with_action
+        {
+            let elapsed_time_us =
+                update_metric_with_elapsed_time(metric, request_processing_start_us);
+            info!("'{}' API request took {} us.", action, elapsed_time_us);
         }
         response
     }
diff --git a/src/utils/src/arg_parser.rs b/src/utils/src/arg_parser.rs
index e76d38b7609..24992594137 100644
--- a/src/utils/src/arg_parser.rs
+++ b/src/utils/src/arg_parser.rs
@@ -77,7 +77,7 @@ impl<'a> ArgParser<'a> {
     }
 
     /// Return a reference to `arguments` field.
-    pub fn arguments(&self) -> &Arguments {
+    pub fn arguments(&self) -> &Arguments<'_> {
         &self.arguments
     }
 
@@ -368,10 +368,10 @@ impl<'a> Arguments<'a> {
             if argument.user_value.is_some() {
                 // For the arguments that require a specific argument to be also present in the list
                 // of arguments provided by user, search for that argument.
-                if let Some(arg_name) = argument.requires {
-                    if !args.contains(&(format!("--{}", arg_name))) {
-                        return Err(UtilsArgParserError::MissingArgument(arg_name.to_string()));
-                    }
+                if let Some(arg_name) = argument.requires
+                    && !args.contains(&(format!("--{}", arg_name)))
+                {
+                    return Err(UtilsArgParserError::MissingArgument(arg_name.to_string()));
                 }
                 // Check the user-provided list for potential forbidden arguments.
                 for arg_name in argument.forbids.iter() {
diff --git a/src/vmm/src/arch/aarch64/mod.rs b/src/vmm/src/arch/aarch64/mod.rs
index a599db5dea7..74c5204af0e 100644
--- a/src/vmm/src/arch/aarch64/mod.rs
+++ b/src/vmm/src/arch/aarch64/mod.rs
@@ -169,10 +169,10 @@ fn get_fdt_addr(mem: &GuestMemoryMmap) -> u64 {
     // we return the start of the DRAM so that
     // we allow the code to try and load the FDT.
 
-    if let Some(addr) = mem.last_addr().checked_sub(layout::FDT_MAX_SIZE as u64 - 1) {
-        if mem.address_in_range(addr) {
-            return addr.raw_value();
-        }
+    if let Some(addr) = mem.last_addr().checked_sub(layout::FDT_MAX_SIZE as u64 - 1)
+        && mem.address_in_range(addr)
+    {
+        return addr.raw_value();
     }
 
     layout::DRAM_MEM_START
diff --git a/src/vmm/src/arch/aarch64/regs.rs b/src/vmm/src/arch/aarch64/regs.rs
index 74a5eaf2be3..7a24337e5c0 100644
--- a/src/vmm/src/arch/aarch64/regs.rs
+++ b/src/vmm/src/arch/aarch64/regs.rs
@@ -243,7 +243,7 @@ impl Aarch64RegisterVec {
     }
 
     /// Returns an iterator over stored registers.
-    pub fn iter(&self) -> impl Iterator<Item = Aarch64RegisterRef> {
+    pub fn iter(&self) -> impl Iterator<Item = Aarch64RegisterRef<'_>> {
         Aarch64RegisterVecIterator {
             index: 0,
             offset: 0,
@@ -253,7 +253,7 @@ impl Aarch64RegisterVec {
     }
 
     /// Returns an iterator over stored registers that allows register modifications.
-    pub fn iter_mut(&mut self) -> impl Iterator<Item = Aarch64RegisterRefMut> {
+    pub fn iter_mut(&mut self) -> impl Iterator<Item = Aarch64RegisterRefMut<'_>> {
         Aarch64RegisterVecIteratorMut {
             index: 0,
             offset: 0,
diff --git a/src/vmm/src/arch/x86_64/mod.rs b/src/vmm/src/arch/x86_64/mod.rs
index 1822abb9009..b18267c6a1e 100644
--- a/src/vmm/src/arch/x86_64/mod.rs
+++ b/src/vmm/src/arch/x86_64/mod.rs
@@ -132,19 +132,19 @@ pub fn arch_memory_regions(size: usize) -> Vec<(GuestAddress, usize)> {
         dram_size,
         u64_to_usize(MMIO32_MEM_START),
         u64_to_usize(MMIO32_MEM_SIZE),
-    ) {
-        if let Some((start_past_64bit_gap, remaining_past_64bit_gap)) = arch_memory_regions_with_gap(
+    ) && let Some((start_past_64bit_gap, remaining_past_64bit_gap)) =
+        arch_memory_regions_with_gap(
             &mut regions,
             start_past_32bit_gap,
             remaining_past_32bit_gap,
             u64_to_usize(MMIO64_MEM_START),
             u64_to_usize(MMIO64_MEM_SIZE),
-        ) {
-            regions.push((
-                GuestAddress(start_past_64bit_gap as u64),
-                remaining_past_64bit_gap,
-            ));
-        }
+        )
+    {
+        regions.push((
+            GuestAddress(start_past_64bit_gap as u64),
+            remaining_past_64bit_gap,
+        ));
     }
 
     regions
diff --git a/src/vmm/src/cpu_config/aarch64/custom_cpu_template.rs b/src/vmm/src/cpu_config/aarch64/custom_cpu_template.rs
index 2869f28ff4a..97e82a47a1c 100644
--- a/src/vmm/src/cpu_config/aarch64/custom_cpu_template.rs
+++ b/src/vmm/src/cpu_config/aarch64/custom_cpu_template.rs
@@ -17,7 +17,7 @@ use crate::cpu_config::templates::{
 use crate::cpu_config::templates_serde::*;
 
 impl GetCpuTemplate for Option<CpuTemplateType> {
-    fn get_cpu_template(&self) -> Result<Cow<CustomCpuTemplate>, GetCpuTemplateError> {
+    fn get_cpu_template(&self) -> Result<Cow<'_, CustomCpuTemplate>, GetCpuTemplateError> {
         match self {
             Some(template_type) => match template_type {
                 CpuTemplateType::Custom(template) => Ok(Cow::Borrowed(template)),
diff --git a/src/vmm/src/cpu_config/templates.rs b/src/vmm/src/cpu_config/templates.rs
index 559da632cc4..bc558a457e4 100644
--- a/src/vmm/src/cpu_config/templates.rs
+++ b/src/vmm/src/cpu_config/templates.rs
@@ -49,7 +49,7 @@ pub enum GetCpuTemplateError {
 /// custom CPU templates and handle static CPU template and custom CPU template in a same manner.
 pub trait GetCpuTemplate {
     /// Get CPU template
-    fn get_cpu_template(&self) -> Result<Cow<CustomCpuTemplate>, GetCpuTemplateError>;
+    fn get_cpu_template(&self) -> Result<Cow<'_, CustomCpuTemplate>, GetCpuTemplateError>;
 }
 
 /// Enum that represents types of cpu templates available.
diff --git a/src/vmm/src/cpu_config/x86_64/custom_cpu_template.rs b/src/vmm/src/cpu_config/x86_64/custom_cpu_template.rs
index 0d8917a4a5e..1e790f1a951 100644
--- a/src/vmm/src/cpu_config/x86_64/custom_cpu_template.rs
+++ b/src/vmm/src/cpu_config/x86_64/custom_cpu_template.rs
@@ -19,7 +19,7 @@ use crate::cpu_config::x86_64::static_cpu_templates::{StaticCpuTemplate, c3, t2,
 use crate::logger::warn;
 
 impl GetCpuTemplate for Option<CpuTemplateType> {
-    fn get_cpu_template(&self) -> Result<Cow<CustomCpuTemplate>, GetCpuTemplateError> {
+    fn get_cpu_template(&self) -> Result<Cow<'_, CustomCpuTemplate>, GetCpuTemplateError> {
         use GetCpuTemplateError::*;
 
         match self {
diff --git a/src/vmm/src/devices/legacy/i8042.rs b/src/vmm/src/devices/legacy/i8042.rs
index 235ce2a7339..eee9957f208 100644
--- a/src/vmm/src/devices/legacy/i8042.rs
+++ b/src/vmm/src/devices/legacy/i8042.rs
@@ -230,11 +230,10 @@ impl vm_device::BusDevice for I8042Device {
                 // Check if we still have data in the internal buffer. If so, we need to trigger
                 // another interrupt, to let the guest know they need to issue another read from
                 // port 0x60.
-                if (self.status & SB_OUT_DATA_AVAIL) != 0 {
-                    if let Err(I8042Error::KbdInterruptFailure(err)) = self.trigger_kbd_interrupt()
-                    {
-                        warn!("Failed to trigger i8042 kbd interrupt {:?}", err);
-                    }
+                if (self.status & SB_OUT_DATA_AVAIL) != 0
+                    && let Err(I8042Error::KbdInterruptFailure(err)) = self.trigger_kbd_interrupt()
+                {
+                    warn!("Failed to trigger i8042 kbd interrupt {:?}", err);
                 }
             }
             _ => read_ok = false,
diff --git a/src/vmm/src/devices/legacy/serial.rs b/src/vmm/src/devices/legacy/serial.rs
index 83e84a7bf56..63834af3cb1 100644
--- a/src/vmm/src/devices/legacy/serial.rs
+++ b/src/vmm/src/devices/legacy/serial.rs
@@ -333,10 +333,10 @@ impl<I: Read + AsRawFd + Send + Debug> MutEventSubscriber
             // Therefore, only try to register stdin to epoll if it is a terminal or a FIFO pipe.
             // SAFETY: isatty has no invariants that need to be upheld. If serial_fd is an invalid
             // argument, it will return 0 and set errno to EBADF.
-            if unsafe { libc::isatty(serial_fd) } == 1 || is_fifo(serial_fd) {
-                if let Err(err) = ops.add(Events::new(&serial_fd, EventSet::IN)) {
-                    warn!("Failed to register serial input fd: {}", err);
-                }
+            if (unsafe { libc::isatty(serial_fd) } == 1 || is_fifo(serial_fd))
+                && let Err(err) = ops.add(Events::new(&serial_fd, EventSet::IN))
+            {
+                warn!("Failed to register serial input fd: {}", err);
             }
             if let Err(err) = ops.add(Events::new(&buf_ready_evt, EventSet::IN)) {
                 warn!("Failed to register serial buffer ready event: {}", err);
diff --git a/src/vmm/src/devices/virtio/block/device.rs b/src/vmm/src/devices/virtio/block/device.rs
index 93eb56e7760..13155efb31d 100644
--- a/src/vmm/src/devices/virtio/block/device.rs
+++ b/src/vmm/src/devices/virtio/block/device.rs
@@ -41,7 +41,7 @@ impl Block {
                 VhostUserBlock::new(config).map_err(BlockError::VhostUserBackend)?,
             ))
         } else {
-            return Err(BlockError::InvalidBlockConfig);
+            Err(BlockError::InvalidBlockConfig)
         }
     }
 
diff --git a/src/vmm/src/devices/virtio/block/virtio/device.rs b/src/vmm/src/devices/virtio/block/virtio/device.rs
index 62ebdbbf5fd..ecdd8ee4f6d 100644
--- a/src/vmm/src/devices/virtio/block/virtio/device.rs
+++ b/src/vmm/src/devices/virtio/block/virtio/device.rs
@@ -455,10 +455,10 @@ impl VirtioBlock {
                 });
         }
 
-        if let FileEngine::Async(ref mut engine) = self.disk.file_engine {
-            if let Err(err) = engine.kick_submission_queue() {
-                error!("BlockError submitting pending block requests: {:?}", err);
-            }
+        if let FileEngine::Async(ref mut engine) = self.disk.file_engine
+            && let Err(err) = engine.kick_submission_queue()
+        {
+            error!("BlockError submitting pending block requests: {:?}", err);
         }
 
         if !used_any {
diff --git a/src/vmm/src/devices/virtio/block/virtio/event_handler.rs b/src/vmm/src/devices/virtio/block/virtio/event_handler.rs
index 03c09a01972..9f02862f814 100644
--- a/src/vmm/src/devices/virtio/block/virtio/event_handler.rs
+++ b/src/vmm/src/devices/virtio/block/virtio/event_handler.rs
@@ -29,14 +29,14 @@ impl VirtioBlock {
         )) {
             error!("Failed to register ratelimiter event: {}", err);
         }
-        if let FileEngine::Async(ref engine) = self.disk.file_engine {
-            if let Err(err) = ops.add(Events::with_data(
+        if let FileEngine::Async(ref engine) = self.disk.file_engine
+            && let Err(err) = ops.add(Events::with_data(
                 engine.completion_evt(),
                 Self::PROCESS_ASYNC_COMPLETION,
                 EventSet::IN,
-            )) {
-                error!("Failed to register IO engine completion event: {}", err);
-            }
+            ))
+        {
+            error!("Failed to register IO engine completion event: {}", err);
         }
     }
 
diff --git a/src/vmm/src/devices/virtio/iovec.rs b/src/vmm/src/devices/virtio/iovec.rs
index 80c5071fbe6..3a2703de82e 100644
--- a/src/vmm/src/devices/virtio/iovec.rs
+++ b/src/vmm/src/devices/virtio/iovec.rs
@@ -569,7 +569,7 @@ mod tests {
         ])
     }
 
-    fn chain(m: &GuestMemoryMmap, is_write_only: bool) -> (Queue, VirtQueue) {
+    fn chain(m: &GuestMemoryMmap, is_write_only: bool) -> (Queue, VirtQueue<'_>) {
         let vq = VirtQueue::new(GuestAddress(0), m, 16);
 
         let mut q = vq.create_queue();
@@ -593,14 +593,14 @@ mod tests {
         (q, vq)
     }
 
-    fn read_only_chain(mem: &GuestMemoryMmap) -> (Queue, VirtQueue) {
+    fn read_only_chain(mem: &GuestMemoryMmap) -> (Queue, VirtQueue<'_>) {
         let v: Vec<u8> = (0..=255).collect();
         mem.write_slice(&v, GuestAddress(0x20000)).unwrap();
 
         chain(mem, false)
     }
 
-    fn write_only_chain(mem: &GuestMemoryMmap) -> (Queue, VirtQueue) {
+    fn write_only_chain(mem: &GuestMemoryMmap) -> (Queue, VirtQueue<'_>) {
         let v = vec![0; 256];
         mem.write_slice(&v, GuestAddress(0x20000)).unwrap();
 
diff --git a/src/vmm/src/devices/virtio/net/device.rs b/src/vmm/src/devices/virtio/net/device.rs
index 70fe5405e22..d235c539c83 100755
--- a/src/vmm/src/devices/virtio/net/device.rs
+++ b/src/vmm/src/devices/virtio/net/device.rs
@@ -525,23 +525,23 @@ impl Net {
             net_metrics.tx_malformed_frames.inc();
         })?;
 
-        if let Some(ns) = mmds_ns {
-            if ns.is_mmds_frame(headers) {
-                let mut frame = vec![0u8; frame_iovec.len() as usize - vnet_hdr_len()];
-                // Ok to unwrap here, because we are passing a buffer that has the exact size
-                // of the `IoVecBuffer` minus the VNET headers.
-                frame_iovec
-                    .read_exact_volatile_at(&mut frame, vnet_hdr_len())
-                    .unwrap();
-                let _ = ns.detour_frame(&frame);
-                METRICS.mmds.rx_accepted.inc();
+        if let Some(ns) = mmds_ns
+            && ns.is_mmds_frame(headers)
+        {
+            let mut frame = vec![0u8; frame_iovec.len() as usize - vnet_hdr_len()];
+            // Ok to unwrap here, because we are passing a buffer that has the exact size
+            // of the `IoVecBuffer` minus the VNET headers.
+            frame_iovec
+                .read_exact_volatile_at(&mut frame, vnet_hdr_len())
+                .unwrap();
+            let _ = ns.detour_frame(&frame);
+            METRICS.mmds.rx_accepted.inc();
 
-                // MMDS frames are not accounted by the rate limiter.
-                Self::rate_limiter_replenish_op(rate_limiter, u64::from(frame_iovec.len()));
+            // MMDS frames are not accounted by the rate limiter.
+            Self::rate_limiter_replenish_op(rate_limiter, u64::from(frame_iovec.len()));
 
-                // MMDS consumed the frame.
-                return Ok(true);
-            }
+            // MMDS consumed the frame.
+            return Ok(true);
         }
 
         // This frame goes to the TAP.
@@ -588,31 +588,30 @@ impl Net {
             }
         }
 
-        if let Some(ns) = self.mmds_ns.as_mut() {
-            if let Some(len) =
+        if let Some(ns) = self.mmds_ns.as_mut()
+            && let Some(len) =
                 ns.write_next_frame(frame_bytes_from_buf_mut(&mut self.rx_frame_buf)?)
-            {
-                let len = len.get();
-                METRICS.mmds.tx_frames.inc();
-                METRICS.mmds.tx_bytes.add(len as u64);
-                init_vnet_hdr(&mut self.rx_frame_buf);
-                self.rx_buffer
-                    .iovec
-                    .write_all_volatile_at(&self.rx_frame_buf[..vnet_hdr_len() + len], 0)?;
-                // SAFETY:
-                // * len will never be bigger that u32::MAX because mmds is bound
-                // by the size of `self.rx_frame_buf` which is MAX_BUFFER_SIZE size.
-                let len: u32 = (vnet_hdr_len() + len).try_into().unwrap();
-
-                // SAFETY:
-                // * We checked that `rx_buffer` includes at least one `DescriptorChain`
-                // * `rx_frame_buf` has size of `MAX_BUFFER_SIZE` and all `DescriptorChain` objects
-                //   are at least that big.
-                unsafe {
-                    self.rx_buffer.mark_used(len, &mut self.queues[RX_INDEX]);
-                }
-                return Ok(Some(len));
+        {
+            let len = len.get();
+            METRICS.mmds.tx_frames.inc();
+            METRICS.mmds.tx_bytes.add(len as u64);
+            init_vnet_hdr(&mut self.rx_frame_buf);
+            self.rx_buffer
+                .iovec
+                .write_all_volatile_at(&self.rx_frame_buf[..vnet_hdr_len() + len], 0)?;
+            // SAFETY:
+            // * len will never be bigger that u32::MAX because mmds is bound
+            // by the size of `self.rx_frame_buf` which is MAX_BUFFER_SIZE size.
+            let len: u32 = (vnet_hdr_len() + len).try_into().unwrap();
+
+            // SAFETY:
+            // * We checked that `rx_buffer` includes at least one `DescriptorChain`
+            // * `rx_frame_buf` has size of `MAX_BUFFER_SIZE` and all `DescriptorChain` objects are
+            //   at least that big.
+            unsafe {
+                self.rx_buffer.mark_used(len, &mut self.queues[RX_INDEX]);
             }
+            return Ok(Some(len));
         }
 
         // SAFETY:
diff --git a/src/vmm/src/devices/virtio/net/test_utils.rs b/src/vmm/src/devices/virtio/net/test_utils.rs
index 6d7bcf15ced..175b23c5626 100644
--- a/src/vmm/src/devices/virtio/net/test_utils.rs
+++ b/src/vmm/src/devices/virtio/net/test_utils.rs
@@ -199,7 +199,7 @@ pub fn create_socket() -> File {
 }
 
 // Returns handles to virtio queues creation/activation and manipulation.
-pub fn virtqueues(mem: &GuestMemoryMmap) -> (VirtQueue, VirtQueue) {
+pub fn virtqueues(mem: &GuestMemoryMmap) -> (VirtQueue<'_>, VirtQueue<'_>) {
     let rxq = VirtQueue::new(GuestAddress(0), mem, 16);
     let txq = VirtQueue::new(GuestAddress(0x1000), mem, 16);
     assert!(rxq.end().0 < txq.start().0);
@@ -355,7 +355,7 @@ pub mod test {
             }
         }
 
-        pub fn net(&mut self) -> MutexGuard<Net> {
+        pub fn net(&mut self) -> MutexGuard<'_, Net> {
             self.net.lock().unwrap()
         }
 
diff --git a/src/vmm/src/devices/virtio/test_utils.rs b/src/vmm/src/devices/virtio/test_utils.rs
index 861394c1c7d..6f1489dd380 100644
--- a/src/vmm/src/devices/virtio/test_utils.rs
+++ b/src/vmm/src/devices/virtio/test_utils.rs
@@ -416,7 +416,7 @@ pub(crate) mod test {
         }
 
         /// Get a (locked) reference to the device
-        pub fn device(&mut self) -> MutexGuard<T> {
+        pub fn device(&mut self) -> MutexGuard<'_, T> {
             self.device.lock().unwrap()
         }
 
diff --git a/src/vmm/src/devices/virtio/transport/mmio.rs b/src/vmm/src/devices/virtio/transport/mmio.rs
index d6cb83b87c6..c20928e3c29 100644
--- a/src/vmm/src/devices/virtio/transport/mmio.rs
+++ b/src/vmm/src/devices/virtio/transport/mmio.rs
@@ -84,7 +84,7 @@ impl MmioTransport {
     }
 
     /// Gets the encapsulated locked VirtioDevice.
-    pub fn locked_device(&self) -> MutexGuard<dyn VirtioDevice + 'static> {
+    pub fn locked_device(&self) -> MutexGuard<'_, dyn VirtioDevice + 'static> {
         self.device.lock().expect("Poisoned lock")
     }
 
diff --git a/src/vmm/src/devices/virtio/vhost_user.rs b/src/vmm/src/devices/virtio/vhost_user.rs
index 556a8adafaf..bd1260fad40 100644
--- a/src/vmm/src/devices/virtio/vhost_user.rs
+++ b/src/vmm/src/devices/virtio/vhost_user.rs
@@ -307,17 +307,16 @@ impl<T: VhostUserHandleBackend> VhostUserHandleImpl<T> {
         acked_features: u64,
         acked_protocol_features: u64,
     ) -> Result<(), VhostUserError> {
-        if acked_features & VhostUserVirtioFeatures::PROTOCOL_FEATURES.bits() != 0 {
-            if let Some(acked_protocol_features) =
+        if acked_features & VhostUserVirtioFeatures::PROTOCOL_FEATURES.bits() != 0
+            && let Some(acked_protocol_features) =
                 VhostUserProtocolFeatures::from_bits(acked_protocol_features)
-            {
-                self.vu
-                    .set_protocol_features(acked_protocol_features)
-                    .map_err(VhostUserError::VhostUserSetProtocolFeatures)?;
+        {
+            self.vu
+                .set_protocol_features(acked_protocol_features)
+                .map_err(VhostUserError::VhostUserSetProtocolFeatures)?;
 
-                if acked_protocol_features.contains(VhostUserProtocolFeatures::REPLY_ACK) {
-                    self.vu.set_hdr_flags(VhostUserHeaderFlag::NEED_REPLY);
-                }
+            if acked_protocol_features.contains(VhostUserProtocolFeatures::REPLY_ACK) {
+                self.vu.set_hdr_flags(VhostUserHeaderFlag::NEED_REPLY);
             }
         }
 
@@ -861,22 +860,22 @@ pub(crate) mod tests {
                 queue_index: usize,
                 config_data: &VringConfigData,
             ) -> Result<(), vhost::Error> {
-                unsafe { (*self.vrings.get())[queue_index].config = *config_data };
+                unsafe { (&mut (*self.vrings.get()))[queue_index].config = *config_data };
                 Ok(())
             }
 
             fn set_vring_base(&self, queue_index: usize, base: u16) -> Result<(), vhost::Error> {
-                unsafe { (*self.vrings.get())[queue_index].base = base };
+                unsafe { (&mut (*self.vrings.get()))[queue_index].base = base };
                 Ok(())
             }
 
             fn set_vring_call(&self, queue_index: usize, fd: &EventFd) -> Result<(), vhost::Error> {
-                unsafe { (*self.vrings.get())[queue_index].call = fd.as_raw_fd() };
+                unsafe { (&mut (*self.vrings.get()))[queue_index].call = fd.as_raw_fd() };
                 Ok(())
             }
 
             fn set_vring_kick(&self, queue_index: usize, fd: &EventFd) -> Result<(), vhost::Error> {
-                unsafe { (*self.vrings.get())[queue_index].kick = fd.as_raw_fd() };
+                unsafe { (&mut (*self.vrings.get()))[queue_index].kick = fd.as_raw_fd() };
                 Ok(())
             }
 
diff --git a/src/vmm/src/devices/virtio/vsock/test_utils.rs b/src/vmm/src/devices/virtio/vsock/test_utils.rs
index b38ce070c66..3d4ab704975 100644
--- a/src/vmm/src/devices/virtio/vsock/test_utils.rs
+++ b/src/vmm/src/devices/virtio/vsock/test_utils.rs
@@ -143,7 +143,7 @@ impl TestContext {
         }
     }
 
-    pub fn create_event_handler_context(&self) -> EventHandlerContext {
+    pub fn create_event_handler_context(&self) -> EventHandlerContext<'_> {
         const QSIZE: u16 = 256;
 
         let guest_rxvq = GuestQ::new(GuestAddress(0x0010_0000), &self.mem, QSIZE);
diff --git a/src/vmm/src/devices/virtio/vsock/unix/muxer_killq.rs b/src/vmm/src/devices/virtio/vsock/unix/muxer_killq.rs
index dc94b38fe36..17cc193d120 100644
--- a/src/vmm/src/devices/virtio/vsock/unix/muxer_killq.rs
+++ b/src/vmm/src/devices/virtio/vsock/unix/muxer_killq.rs
@@ -104,10 +104,10 @@ impl MuxerKillQ {
     /// This will succeed and return a connection key, only if the connection at the front of
     /// the queue has expired. Otherwise, `None` is returned.
     pub fn pop(&mut self) -> Option<ConnMapKey> {
-        if let Some(item) = self.q.front() {
-            if Instant::now() > item.kill_time {
-                return self.q.pop_front().map(|entry| entry.key);
-            }
+        if let Some(item) = self.q.front()
+            && Instant::now() > item.kill_time
+        {
+            return self.q.pop_front().map(|entry| entry.key);
         }
         None
     }
diff --git a/src/vmm/src/dumbo/pdu/ipv4.rs b/src/vmm/src/dumbo/pdu/ipv4.rs
index fab5b88eb49..e49a1f9a025 100644
--- a/src/vmm/src/dumbo/pdu/ipv4.rs
+++ b/src/vmm/src/dumbo/pdu/ipv4.rs
@@ -568,7 +568,7 @@ mod tests {
 
         // Using a helper function here instead of a closure because it's hard (impossible?) to
         // specify lifetime bounds for closure arguments.
-        fn p(buf: &mut [u8]) -> IPv4Packet<&mut [u8]> {
+        fn p(buf: &mut [u8]) -> IPv4Packet<'_, &mut [u8]> {
             IPv4Packet::from_bytes_unchecked(buf)
         }
 
diff --git a/src/vmm/src/dumbo/pdu/tcp.rs b/src/vmm/src/dumbo/pdu/tcp.rs
index 2ac01227142..ab46da2367a 100644
--- a/src/vmm/src/dumbo/pdu/tcp.rs
+++ b/src/vmm/src/dumbo/pdu/tcp.rs
@@ -304,10 +304,10 @@ impl<T: NetworkBytes + Debug> TcpSegment<'_, T> {
             return Err(TcpError::HeaderLen);
         }
 
-        if let Some((src_addr, dst_addr)) = verify_checksum {
-            if segment.compute_checksum(src_addr, dst_addr) != 0 {
-                return Err(TcpError::Checksum);
-            }
+        if let Some((src_addr, dst_addr)) = verify_checksum
+            && segment.compute_checksum(src_addr, dst_addr) != 0
+        {
+            return Err(TcpError::Checksum);
         }
 
         Ok(segment)
@@ -739,7 +739,7 @@ mod tests {
 
         // Using a helper function here instead of a closure because it's hard (impossible?) to
         // specify lifetime bounds for closure arguments.
-        fn p(buf: &mut [u8]) -> TcpSegment<&mut [u8]> {
+        fn p(buf: &mut [u8]) -> TcpSegment<'_, &mut [u8]> {
             TcpSegment::from_bytes_unchecked(buf)
         }
 
diff --git a/src/vmm/src/dumbo/tcp/connection.rs b/src/vmm/src/dumbo/tcp/connection.rs
index 016a44477a7..311abf7c3aa 100644
--- a/src/vmm/src/dumbo/tcp/connection.rs
+++ b/src/vmm/src/dumbo/tcp/connection.rs
@@ -654,13 +654,13 @@ impl Connection {
         let mut enqueue_ack = if payload_len > 0 {
             let data_end_seq = seq + wrapping_payload_len;
 
-            if let Some(fin_seq) = self.fin_received {
-                if !seq_at_or_after(fin_seq, data_end_seq) {
-                    // TODO: This is a strange situation, because the other endpoint is sending data
-                    // after it initially closed its half of the connection. We simply ignore the
-                    // segment for now.
-                    return Ok((None, recv_status_flags | RecvStatusFlags::DATA_BEYOND_FIN));
-                }
+            if let Some(fin_seq) = self.fin_received
+                && !seq_at_or_after(fin_seq, data_end_seq)
+            {
+                // TODO: This is a strange situation, because the other endpoint is sending data
+                // after it initially closed its half of the connection. We simply ignore the
+                // segment for now.
+                return Ok((None, recv_status_flags | RecvStatusFlags::DATA_BEYOND_FIN));
             }
 
             if !seq_at_or_after(self.local_rwnd_edge, data_end_seq) {
@@ -890,14 +890,14 @@ impl Connection {
                         return self.write_next_segment(buf, mss_reserved, payload_src, now);
                     }
 
-                    if let Some(fin_seq) = self.send_fin {
-                        if self.highest_ack_received == fin_seq {
-                            // We're in the relatively unlikely situation where our FIN got lost.
-                            // Simply calling write_control_segment() will retransmit it.
-                            let segment = self.write_control_segment::<R>(buf, mss_reserved)?;
-                            self.rto_start = now;
-                            return Ok(Some(segment));
-                        }
+                    if let Some(fin_seq) = self.send_fin
+                        && self.highest_ack_received == fin_seq
+                    {
+                        // We're in the relatively unlikely situation where our FIN got lost.
+                        // Simply calling write_control_segment() will retransmit it.
+                        let segment = self.write_control_segment::<R>(buf, mss_reserved)?;
+                        self.rto_start = now;
+                        return Ok(Some(segment));
                     }
 
                     // We have to remember this is a retransmission for later.
@@ -929,10 +929,10 @@ impl Connection {
 
             // Make sure we're not trying to send data past the FIN sequence we previously
             // announced.
-            if let Some(fin_seq) = self.send_fin {
-                if seq_after(actual_end, fin_seq) {
-                    return Err(WriteNextError::DataAfterFin);
-                }
+            if let Some(fin_seq) = self.send_fin
+                && seq_after(actual_end, fin_seq)
+            {
+                return Err(WriteNextError::DataAfterFin);
             }
 
             // We only proceed with writing a data segment if the previously computed bounds
@@ -960,21 +960,21 @@ impl Connection {
                 let payload_len = segment.inner().payload_len();
                 let mut first_seq_after = seq_to_send + Wrapping(u32::from(payload_len));
 
-                if let Some(fin_seq) = self.send_fin {
-                    if first_seq_after == fin_seq {
-                        // This segment contains the last bytes of data we're going to send, so
-                        // we should also set the FIN flag.
-                        segment
-                            .inner_mut()
-                            .set_flags_after_ns(tcp_flags | TcpFlags::FIN);
-
-                        // The FIN takes up 1 sequence number.
-                        first_seq_after += Wrapping(1);
-                        // The main purpose of knowing we sent at least one FIN is to signal that
-                        // we already added 1 to self.first_not_sent, to account for its sequence
-                        // number.
-                        self.set_flags(ConnStatusFlags::FIN_SENT);
-                    }
+                if let Some(fin_seq) = self.send_fin
+                    && first_seq_after == fin_seq
+                {
+                    // This segment contains the last bytes of data we're going to send, so
+                    // we should also set the FIN flag.
+                    segment
+                        .inner_mut()
+                        .set_flags_after_ns(tcp_flags | TcpFlags::FIN);
+
+                    // The FIN takes up 1 sequence number.
+                    first_seq_after += Wrapping(1);
+                    // The main purpose of knowing we sent at least one FIN is to signal that
+                    // we already added 1 to self.first_not_sent, to account for its sequence
+                    // number.
+                    self.set_flags(ConnStatusFlags::FIN_SENT);
                 }
 
                 if rto_triggered || self.first_not_sent == self.highest_ack_received {
@@ -1122,7 +1122,7 @@ pub(crate) mod tests {
             &mut self,
             c: &mut Connection,
             payload_src: Option<(&[u8], Wrapping<u32>)>,
-        ) -> Result<Option<TcpSegment<&mut [u8]>>, WriteNextError> {
+        ) -> Result<Option<TcpSegment<'_, &mut [u8]>>, WriteNextError> {
             let src_port = self.src_port;
             let dst_port = self.dst_port;
             c.write_next_segment(self.buf.as_mut(), self.mss_reserved, payload_src, self.now)
diff --git a/src/vmm/src/dumbo/tcp/handler.rs b/src/vmm/src/dumbo/tcp/handler.rs
index d8e903a46b6..1be2bb9360c 100644
--- a/src/vmm/src/dumbo/tcp/handler.rs
+++ b/src/vmm/src/dumbo/tcp/handler.rs
@@ -315,10 +315,10 @@ impl TcpIPv4Handler {
         tuple: ConnectionTuple,
         status: NextSegmentStatus,
     ) -> bool {
-        if let Some((_, timeout_tuple)) = self.next_timeout {
-            if tuple == timeout_tuple {
-                self.find_next_timeout();
-            }
+        if let Some((_, timeout_tuple)) = self.next_timeout
+            && tuple == timeout_tuple
+        {
+            self.find_next_timeout();
         }
         match status {
             NextSegmentStatus::Available => {
@@ -342,10 +342,10 @@ impl TcpIPv4Handler {
         self.active_connections.remove(&tuple);
         self.connections.remove(&tuple);
 
-        if let Some((_, timeout_tuple)) = self.next_timeout {
-            if timeout_tuple == tuple {
-                self.find_next_timeout();
-            }
+        if let Some((_, timeout_tuple)) = self.next_timeout
+            && timeout_tuple == tuple
+        {
+            self.find_next_timeout();
         }
     }
 
diff --git a/src/vmm/src/logger/metrics.rs b/src/vmm/src/logger/metrics.rs
index d5098cbf748..e10e746d3d1 100644
--- a/src/vmm/src/logger/metrics.rs
+++ b/src/vmm/src/logger/metrics.rs
@@ -746,7 +746,7 @@ impl LatencyAggregateMetrics {
     /// 1st for start_time_us = get_time_us()
     /// 2nd for delta_time_us = get_time_us() - start_time; and metrics.store(delta_time_us)
     /// we have just `_m = metrics.record_latency_metrics()`
-    pub fn record_latency_metrics(&self) -> LatencyMetricsRecorder {
+    pub fn record_latency_metrics(&self) -> LatencyMetricsRecorder<'_> {
         LatencyMetricsRecorder::new(self)
     }
 }
diff --git a/src/vmm/src/mmds/ns.rs b/src/vmm/src/mmds/ns.rs
index 8f9a764a7c1..a31cb7247b9 100644
--- a/src/vmm/src/mmds/ns.rs
+++ b/src/vmm/src/mmds/ns.rs
@@ -386,7 +386,7 @@ mod tests {
             eth_unsized.with_payload_len_unchecked(packet_len).len()
         }
 
-        fn next_frame_as_ipv4_packet<'a>(&mut self, buf: &'a mut [u8]) -> IPv4Packet<&'a [u8]> {
+        fn next_frame_as_ipv4_packet<'a>(&mut self, buf: &'a mut [u8]) -> IPv4Packet<'_, &'a [u8]> {
             let len = self.write_next_frame(buf).unwrap().get();
             let eth = EthernetFrame::from_bytes(&buf[..len]).unwrap();
             IPv4Packet::from_bytes(&buf[eth.payload_offset()..len], true).unwrap()
diff --git a/src/vmm/src/resources.rs b/src/vmm/src/resources.rs
index 911ee5e5c99..0d2f4bbed22 100644
--- a/src/vmm/src/resources.rs
+++ b/src/vmm/src/resources.rs
@@ -451,7 +451,7 @@ impl VmResources {
         // Create `MmdsNetworkStack` and configure the IPv4 address for
         // existing built network devices whose names are defined in the
         // network interface ID list.
-        for net_device in self.net_builder.iter_mut() {
+        for net_device in self.net_builder.iter() {
             let mut net_device_lock = net_device.lock().expect("Poisoned lock");
             if network_interfaces.contains(net_device_lock.id()) {
                 net_device_lock.configure_mmds_network_stack(ipv4_addr, mmds.clone());
diff --git a/src/vmm/src/vmm_config/net.rs b/src/vmm/src/vmm_config/net.rs
index f1413368090..81a2db49f33 100644
--- a/src/vmm/src/vmm_config/net.rs
+++ b/src/vmm/src/vmm_config/net.rs
@@ -89,15 +89,10 @@ impl NetBuilder {
     }
 
     /// Returns a immutable iterator over the network devices.
-    pub fn iter(&self) -> ::std::slice::Iter<Arc<Mutex<Net>>> {
+    pub fn iter(&self) -> ::std::slice::Iter<'_, Arc<Mutex<Net>>> {
         self.net_devices.iter()
     }
 
-    /// Returns a mutable iterator over the network devices.
-    pub fn iter_mut(&mut self) -> ::std::slice::IterMut<Arc<Mutex<Net>>> {
-        self.net_devices.iter_mut()
-    }
-
     /// Adds an existing network device in the builder.
     pub fn add_device(&mut self, device: Arc<Mutex<Net>>) {
         self.net_devices.push(device);
diff --git a/src/vmm/src/vstate/vm.rs b/src/vmm/src/vstate/vm.rs
index 31eb8d1ccd1..deef6710b90 100644
--- a/src/vmm/src/vstate/vm.rs
+++ b/src/vmm/src/vstate/vm.rs
@@ -410,7 +410,7 @@ impl Vm {
     }
 
     /// Gets a mutable reference to this [`Vm`]'s [`ResourceAllocator`] object
-    pub fn resource_allocator(&self) -> MutexGuard<ResourceAllocator> {
+    pub fn resource_allocator(&self) -> MutexGuard<'_, ResourceAllocator> {
         self.common
             .resource_allocator
             .lock()
diff --git a/tests/framework/properties.py b/tests/framework/properties.py
index 29041ab6e64..0c430cfd41d 100644
--- a/tests/framework/properties.py
+++ b/tests/framework/properties.py
@@ -26,7 +26,7 @@ def get_os_version():
     """Get the OS version
 
     >>> get_os_version()
-    'Ubuntu 24.04.2 LTS'
+    'Ubuntu 24.04.3 LTS'
     """
 
     os_release = Path("/etc/os-release").read_text(encoding="ascii")
diff --git a/tests/integration_tests/test_kani.py b/tests/integration_tests/test_kani.py
index 9660dde75fc..2ef9a29de6a 100644
--- a/tests/integration_tests/test_kani.py
+++ b/tests/integration_tests/test_kani.py
@@ -34,7 +34,7 @@ def test_kani(results_dir):
     # --output-format terse is required by -j
     # -Z unstable-options is needed to enable the other `-Z` flags
     _, stdout, _ = utils.check_output(
-        "cargo kani -Z unstable-options -Z stubbing -Z function-contracts -Z restrict-vtable -j --output-format terse --harness-timeout 40m",
+        "cargo kani -Z unstable-options -Z stubbing -Z function-contracts -Z restrict-vtable -j --output-format terse --harness-timeout 40m --workspace",
         timeout=TIMEOUT,
     )
 
diff --git a/tools/devctr/Dockerfile b/tools/devctr/Dockerfile
index 1d81d5b37bb..85ee76e476b 100644
--- a/tools/devctr/Dockerfile
+++ b/tools/devctr/Dockerfile
@@ -4,7 +4,7 @@ FROM public.ecr.aws/lts/ubuntu:24.04
 # The Rust toolchain layer will get updated most frequently, but we could keep the system
 # dependencies layer intact for much longer.
 
-ARG RUST_TOOLCHAIN="1.87.0"
+ARG RUST_TOOLCHAIN="1.89.0"
 ARG TMP_BUILD_DIR=/tmp/build
 ARG DEBIAN_FRONTEND=noninteractive
 ARG PIP_BREAK_SYSTEM_PACKAGES=1
@@ -122,7 +122,7 @@ RUN curl https://sh.rustup.rs -sSf | sh -s -- -y --profile minimal --default-too
     && rustup component add llvm-tools-preview clippy rustfmt \
     && cargo install --locked cargo-audit grcov cargo-sort cargo-afl \
     && cargo install --locked cargo-deny --version 0.17.0 \
-    && cargo install --locked kani-verifier && cargo kani setup \
+    && cargo install --locked kani-verifier --version 0.64.0 && cargo kani setup \
     \
     && NIGHTLY_TOOLCHAIN=$(rustup toolchain list | grep nightly | tr -d '\n') \
     && rustup component add rust-src --toolchain "$NIGHTLY_TOOLCHAIN" \
diff --git a/tools/devtool b/tools/devtool
index 45580f2ae57..5bac70d0310 100755
--- a/tools/devtool
+++ b/tools/devtool
@@ -68,7 +68,7 @@
 DEVCTR_IMAGE_NO_TAG="public.ecr.aws/firecracker/fcuvm"
 
 # Development container tag
-DEVCTR_IMAGE_TAG=${DEVCTR_IMAGE_TAG:-v83}
+DEVCTR_IMAGE_TAG=${DEVCTR_IMAGE_TAG:-v84}
 
 # Development container image (name:tag)
 # This should be updated whenever we upgrade the development container.