diff --git a/server/lib/src/entry.rs b/server/lib/src/entry.rs
index ff5e9dd4d..7a6dfec85 100644
--- a/server/lib/src/entry.rs
+++ b/server/lib/src/entry.rs
@@ -735,6 +735,7 @@ impl Entry<EntryIncremental, EntryNew> {
 
                             match (self.attrs.get(attr_name), db_ent.attrs.get(attr_name)) {
                                 (Some(vs_left), Some(vs_right)) if take_left => {
+                                    #[allow(clippy::todo)]
                                     if let Some(_attr_state) = vs_left.repl_merge_valueset(vs_right)
                                     {
                                         todo!();
@@ -744,6 +745,7 @@ impl Entry<EntryIncremental, EntryNew> {
                                     }
                                 }
                                 (Some(vs_left), Some(vs_right)) => {
+                                    #[allow(clippy::todo)]
                                     if let Some(_attr_state) = vs_right.repl_merge_valueset(vs_left)
                                     {
                                         todo!();
@@ -907,6 +909,7 @@ impl Entry<EntryIncremental, EntryCommitted> {
             attrs: self.attrs,
         };
 
+        #[allow(clippy::todo)]
         if let Err(e) = ne.validate(schema) {
             warn!(uuid = ?self.valid.uuid, err = ?e, "Entry failed schema check, moving to a conflict state");
             ne.add_ava_int("class", Value::new_class("conflict"));
diff --git a/server/lib/src/lib.rs b/server/lib/src/lib.rs
index 36121cdd4..711f76bdb 100644
--- a/server/lib/src/lib.rs
+++ b/server/lib/src/lib.rs
@@ -4,7 +4,9 @@
 #![deny(warnings)]
 #![recursion_limit = "512"]
 #![warn(unused_extern_crates)]
-#![deny(clippy::todo)]
+// TODO: can't use this until we have a better way to handle the 'todo' lint?
+// #![deny(clippy::todo)]
+#![warn(clippy::todo)]
 #![deny(clippy::unimplemented)]
 #![deny(clippy::unwrap_used)]
 #![deny(clippy::expect_used)]
diff --git a/server/lib/src/repl/consumer.rs b/server/lib/src/repl/consumer.rs
index 00f7c2cdb..5acd36abf 100644
--- a/server/lib/src/repl/consumer.rs
+++ b/server/lib/src/repl/consumer.rs
@@ -69,6 +69,8 @@ impl<'a> QueryServerWriteTransaction<'a> {
         //    /- entries that need to be created as conflicts.
         //    |                /- entries that survive and need update to the db in place.
         //    v                v
+
+        #[allow(clippy::todo)]
         let (conflict_create, conflict_update): (
             Vec<EntrySealedNew>,
             Vec<(EntryIncrementalCommitted, Arc<EntrySealedCommitted>)>,
@@ -217,6 +219,7 @@ impl<'a> QueryServerWriteTransaction<'a> {
                 error!("This server's content must be refreshed to proceed. If you have configured automatic refresh, this will occur shortly.");
                 Ok(ConsumerState::RefreshRequired)
             }
+            #[allow(clippy::todo)]
             ReplIncrementalContext::UnwillingToSupply => {
                 todo!();
             }
diff --git a/server/lib/src/valueset/session.rs b/server/lib/src/valueset/session.rs
index df9395b71..227752d98 100644
--- a/server/lib/src/valueset/session.rs
+++ b/server/lib/src/valueset/session.rs
@@ -498,6 +498,7 @@ impl ValueSetT for ValueSetSession {
         Ok(Box::new(ValueSetApiToken { map }))
     }
 
+    #[allow(clippy::todo)]
     fn repl_merge_valueset(&self, _older: &ValueSet) -> Option<ValueSet> {
         todo!();
     }
@@ -872,6 +873,7 @@ impl ValueSetT for ValueSetOauth2Session {
         Some(Box::new(self.map.values().map(|m| &m.rs_uuid).copied()))
     }
 
+    #[allow(clippy::todo)]
     fn repl_merge_valueset(&self, _older: &ValueSet) -> Option<ValueSet> {
         todo!();
     }
diff --git a/unix_integration/pam_kanidm/src/pam/module.rs b/unix_integration/pam_kanidm/src/pam/module.rs
index a346bddbd..5ea8fbfd0 100755
--- a/unix_integration/pam_kanidm/src/pam/module.rs
+++ b/unix_integration/pam_kanidm/src/pam/module.rs
@@ -33,7 +33,7 @@ extern "C" {
         pamh: *const PamHandle,
         module_data_name: *const c_char,
         data: *mut PamDataT,
-        cleanup: extern "C" fn(
+        cleanup: unsafe extern "C" fn(
             pamh: *const PamHandle,
             data: *mut PamDataT,
             error_status: PamResultCode,
@@ -56,12 +56,13 @@ extern "C" {
     ) -> PamResultCode;
 }
 
-pub extern "C" fn cleanup<T>(_: *const PamHandle, c_data: *mut PamDataT, _: PamResultCode) {
-    unsafe {
-        let c_data = Box::from_raw(c_data);
-        let data: Box<T> = mem::transmute(c_data);
-        mem::drop(data);
-    }
+/// # Safety
+///
+/// We're doing what we can for this one, but it's FFI.
+pub unsafe extern "C" fn cleanup<T>(_: *const PamHandle, c_data: *mut PamDataT, _: PamResultCode) {
+    let c_data = Box::from_raw(c_data);
+    let data: Box<T> = mem::transmute(c_data);
+    mem::drop(data);
 }
 
 pub type PamResult<T> = Result<T, PamResultCode>;