diff --git a/core/embed/rust/src/protobuf/encode.rs b/core/embed/rust/src/protobuf/encode.rs
index 78883e714..3f0b33cd2 100644
--- a/core/embed/rust/src/protobuf/encode.rs
+++ b/core/embed/rust/src/protobuf/encode.rs
@@ -38,12 +38,10 @@ pub extern "C" fn protobuf_encode(buf: Obj, obj: Obj) -> Obj {
     util::try_or_raise(|| {
         let obj = Gc::<MsgObj>::try_from(obj)?;
 
+        // We assume there are no other refs into `buf` at this point. This specifically
+        // means that no fields of `obj` should reference `buf` memory.
         let buf = &mut BufferMut::try_from(buf)?;
-        let stream = &mut BufferStream::new(unsafe {
-            // SAFETY: We assume there are no other refs into `buf` at this point. This
-            // specifically means that no fields of `obj` should reference `buf` memory.
-            buf.as_mut()
-        });
+        let stream = &mut BufferStream::new(buf.as_mut());
 
         Encoder.encode_message(stream, &obj.def(), &obj)?;