diff --git a/cc_bindings_from_rs/generate_bindings/format_type.rs b/cc_bindings_from_rs/generate_bindings/format_type.rs
index b16551db3..2fd396d9b 100644
--- a/cc_bindings_from_rs/generate_bindings/format_type.rs
+++ b/cc_bindings_from_rs/generate_bindings/format_type.rs
@@ -85,6 +85,7 @@ fn format_pointer_or_reference_ty_for_cc<'tcx>(
     pointee: Ty<'tcx>,
     mutability: Mutability,
     pointer_sigil: TokenStream,
+    is_reference: bool,
 ) -> Result<CcSnippet<'tcx>> {
     let tcx = db.tcx();
     let const_qualifier = match mutability {
@@ -92,7 +93,14 @@ fn format_pointer_or_reference_ty_for_cc<'tcx>(
         Mutability::Not => quote! { const },
     };
     if pointee.is_c_void(tcx) {
-        return Ok(CcSnippet { tokens: quote! { #const_qualifier void* }, ..Default::default() });
+        let mut prereqs = CcPrerequisites::default();
+        let tokens = if is_reference {
+            prereqs.includes.insert(db.support_header("annotations_internal.h"));
+            quote! { #const_qualifier void* crubit_nonnull }
+        } else {
+            quote! { #const_qualifier void #pointer_sigil }
+        };
+        return Ok(CcSnippet { tokens, prereqs });
     }
     let CcSnippet { tokens, mut prereqs } = db.format_ty_for_cc(pointee, TypeLocation::Other)?;
     prereqs.move_defs_to_fwd_decls();
@@ -135,6 +143,7 @@ fn format_transparent_pointee_or_reference_for_cc<'tcx>(
     referent_ty: Ty<'tcx>,
     mutability: rustc_middle::mir::Mutability,
     pointer_sigil: TokenStream,
+    is_reference: bool,
 ) -> Option<CcSnippet<'tcx>> {
     let ty::TyKind::Adt(adt, substs) = referent_ty.kind() else {
         return None;
@@ -147,7 +156,8 @@ fn format_transparent_pointee_or_reference_for_cc<'tcx>(
     }
 
     let referent = substs[0].expect_ty();
-    format_pointer_or_reference_ty_for_cc(db, referent, mutability, pointer_sigil).ok()
+    format_pointer_or_reference_ty_for_cc(db, referent, mutability, pointer_sigil, is_reference)
+        .ok()
 }
 
 fn format_legacy_bridged_type_with_placeholders<'tcx>(
@@ -380,6 +390,7 @@ pub fn format_ty_for_cc<'tcx>(
                     referent,
                     Mutability::Mut,
                     quote! { && },
+                    /*is_reference=*/ true,
                 );
             }
             let def_id = adt.did();
@@ -504,17 +515,25 @@ pub fn format_ty_for_cc<'tcx>(
                 check_slice_layout(db.tcx(), ty);
                 return format_slice_ref_for_cc(db, *slice_ty, mutbl);
             }
-            // Early return in case we handle a transparent pointer type.
-            if let Some(snippet) =
-                format_transparent_pointee_or_reference_for_cc(db, pointee_ty, mutbl, quote! { * })
-            {
-                return Ok(snippet);
-            }
-
-            format_pointer_or_reference_ty_for_cc(db, pointee_ty, mutbl, quote! { * })
+            let sigil = quote! { * crubit_nullability_unknown };
+            let mut snippet = if let Some(snippet) = format_transparent_pointee_or_reference_for_cc(
+                db,
+                pointee_ty,
+                mutbl,
+                sigil.clone(),
+                /*is_reference=*/ false,
+            ) {
+                snippet
+            } else {
+                format_pointer_or_reference_ty_for_cc(
+                    db, pointee_ty, mutbl, sigil, /*is_reference=*/ false,
+                )
                 .with_context(|| {
                     format!("Failed to format the pointee of the pointer type `{ty}`")
                 })?
+            };
+            snippet.prereqs.includes.insert(db.support_header("annotations_internal.h"));
+            snippet
         }
 
         ty::TyKind::Ref(region, referent, mutability) => {
@@ -559,17 +578,21 @@ pub fn format_ty_for_cc<'tcx>(
                 referent,
                 mutability,
                 ptr_or_ref_prefix.clone(),
+                /*is_reference=*/ true,
             ) {
                 snippet.prereqs += prereqs;
                 return Ok(snippet);
             }
 
-            let tokens =
-                format_pointer_or_reference_ty_for_cc(db, referent, mutability, ptr_or_ref_prefix)
-                    .with_context(|| {
-                        format!("Failed to format the referent of the reference type `{ty}`")
-                    })?
-                    .into_tokens(&mut prereqs);
+            let tokens = format_pointer_or_reference_ty_for_cc(
+                db,
+                referent,
+                mutability,
+                ptr_or_ref_prefix,
+                /*is_reference=*/ true,
+            )
+            .with_context(|| format!("Failed to format the referent of the reference type `{ty}`"))?
+            .into_tokens(&mut prereqs);
             CcSnippet { tokens, prereqs }
         }
         ty::TyKind::FnPtr(sig_tys, fn_header) => {
diff --git a/cc_bindings_from_rs/generate_bindings/format_type_test.rs b/cc_bindings_from_rs/generate_bindings/format_type_test.rs
index 344589b7d..1dfde3d3d 100644
--- a/cc_bindings_from_rs/generate_bindings/format_type_test.rs
+++ b/cc_bindings_from_rs/generate_bindings/format_type_test.rs
@@ -171,8 +171,8 @@ fn test_format_ty_for_cc_successes() {
         case!(rs: "SomeStruct", cc: "::rust_out::SomeStruct", includes: [],  prereq_def: "SomeStruct"),
         case!(rs: "SomeEnum", cc: "::rust_out::SomeEnum", includes: [], prereq_def: "SomeEnum"),
         case!(rs: "SomeUnion", cc: "::rust_out::SomeUnion", includes: [], prereq_def: "SomeUnion"),
-        case!(rs: "*const i32", cc: "::std :: int32_t const *", includes: ["<cstdint>"]),
-        case!(rs: "*mut i32", cc: "::std :: int32_t *", includes: ["<cstdint>"]),
+        case!(rs: "*const i32", cc: "::std :: int32_t const * crubit_nullability_unknown", includes: ["<cstdint>", "<crubit/support/for/tests/annotations_internal.h>"]),
+        case!(rs: "*mut i32", cc: "::std :: int32_t * crubit_nullability_unknown", includes: ["<cstdint>", "<crubit/support/for/tests/annotations_internal.h>"]),
         case!(
             rs: "&'static i32",
             cc: "::std :: int32_t const * $static crubit_nonnull",
@@ -219,20 +219,20 @@ fn test_format_ty_for_cc_successes() {
         // `SomeStruct` is a `fwd_decls` prerequisite (not `defs` prerequisite):
         case!(
             rs: "*mut SomeStruct",
-            cc: "::rust_out::SomeStruct*",
-            includes: [],
+            cc: "::rust_out::SomeStruct * crubit_nullability_unknown",
+            includes: ["<crubit/support/for/tests/annotations_internal.h>"],
             prereq_fwd_decl: "SomeStruct"
         ),
         // Testing propagation of deeper/nested `fwd_decls`:
         case!(
             rs: "*mut *mut SomeStruct",
-            cc: ":: rust_out :: SomeStruct * *",
-            includes: [],
+            cc: ":: rust_out :: SomeStruct * crubit_nullability_unknown * crubit_nullability_unknown",
+            includes: ["<crubit/support/for/tests/annotations_internal.h>"],
             prereq_fwd_decl: "SomeStruct"
         ),
         // Testing propagation of `const` / `mut` qualifiers:
-        case!(rs: "*mut *const f32", cc: "float const * *"),
-        case!(rs: "*const *mut f32", cc: "float * const *"),
+        case!(rs: "*mut *const f32", cc: "float const * crubit_nullability_unknown * crubit_nullability_unknown", includes: ["<crubit/support/for/tests/annotations_internal.h>"]),
+        case!(rs: "*const *mut f32", cc: "float * crubit_nullability_unknown const * crubit_nullability_unknown", includes: ["<crubit/support/for/tests/annotations_internal.h>"]),
         // Rust function pointers are non-nullable, so when function pointers are used as a
         // parameter type (i.e. in `TypeLocation::FnParam`) then we can translate to
         // generate a C++ function *reference*, rather than a C++ function *pointer*.
@@ -252,16 +252,16 @@ fn test_format_ty_for_cc_successes() {
         // function *reference*.
         case!(
             rs: "*const extern \"C\" fn (f32, f32) -> f32",
-            cc: "crubit :: type_identity_t < float (float , float) > * const *",
-            includes: ["<crubit/support/for/tests/internal/cxx20_backports.h>"]
+            cc: "crubit :: type_identity_t < float (float , float) > * const * crubit_nullability_unknown",
+            includes: ["<crubit/support/for/tests/annotations_internal.h>", "<crubit/support/for/tests/internal/cxx20_backports.h>"]
         ),
         // Extra parens/sugar are expected to be ignored:
         case!(rs: "(bool)", cc: "bool"),
         // References to MaybeUninit:
         case!(
             rs: "*const std::mem::MaybeUninit<i32>",
-            cc: "::std :: int32_t const *",
-            includes: ["<cstdint>"]
+            cc: "::std :: int32_t const * crubit_nullability_unknown",
+            includes: ["<cstdint>", "<crubit/support/for/tests/annotations_internal.h>"]
         ),
         case!(
             rs: "&mut std::mem::MaybeUninit<i32>",
@@ -286,13 +286,13 @@ fn test_format_ty_for_cc_successes() {
         // TyKind::Array
         case!(
             rs: "*mut [i32; 42]",
-            cc: "::std::array < ::std::int32_t, 42> *",
-            includes: ["<array>", "<cstdint>"]
+            cc: "::std::array < ::std::int32_t, 42> * crubit_nullability_unknown",
+            includes: ["<array>", "<cstdint>", "<crubit/support/for/tests/annotations_internal.h>"]
         ),
         case!(
             rs: "*const [i32; 42]",
-            cc: "::std::array < ::std::int32_t, 42> const *",
-            includes: ["<array>", "<cstdint>"]
+            cc: "::std::array < ::std::int32_t, 42> const * crubit_nullability_unknown",
+            includes: ["<array>", "<cstdint>", "<crubit/support/for/tests/annotations_internal.h>"]
         ),
         case!(
             rs: "[i32; 42]",
diff --git a/cc_bindings_from_rs/generate_bindings/generate_bindings_test.rs b/cc_bindings_from_rs/generate_bindings/generate_bindings_test.rs
index 527e745e4..377f35b3d 100644
--- a/cc_bindings_from_rs/generate_bindings/generate_bindings_test.rs
+++ b/cc_bindings_from_rs/generate_bindings/generate_bindings_test.rs
@@ -174,11 +174,11 @@ fn test_generated_bindings_prereq_fwd_decls_for_ptr_param() {
                     // below also matters.
                     struct S;
                     ...
-                    void F(::rust_out::S const* __param_0);
+                    void F(::rust_out::S const* crubit_nullability_unknown __param_0);
                     ...
                     struct CRUBIT_INTERNAL_RUST_TYPE(...) alignas(...) [[clang::trivial_abi]] S final { ... }
                     ...
-                    inline void F(::rust_out::S const* __param_0) { ... }
+                    inline void F(::rust_out::S const* crubit_nullability_unknown __param_0) { ... }
                     ...
                 }  // namespace rust_out
             }
@@ -335,7 +335,7 @@ fn test_generated_bindings_prereq_fwd_decls_not_needed_inside_struct_definition(
             bindings.cc_api,
             quote! {
                 static ::rust_out::S create(); ...
-                union { ... ::rust_out::S const* field; }; ...
+                union { ... ::rust_out::S const* crubit_nullability_unknown field; }; ...
             }
         );
     });
@@ -1292,7 +1292,7 @@ fn test_format_item_struct_with_custom_drop_and_no_default_and_clone(test_src: &
                 }
                 ...
                 namespace __crubit_internal {  // `pass_by_value` thunk decl
-                extern "C" void ...(::rust_out::TypeUnderTest* __ret_ptr);
+                extern "C" void ...(::rust_out::TypeUnderTest* crubit_nonnull __ret_ptr);
                 }
                 inline ::rust_out::TypeUnderTest TypeUnderTest::pass_by_value() {
                     crubit::Slot<::rust_out::TypeUnderTest> __return_value_ret_val_holder;
diff --git a/cc_bindings_from_rs/generate_bindings/generate_function_test.rs b/cc_bindings_from_rs/generate_bindings/generate_function_test.rs
index f2b68cd9b..82dbdc763 100644
--- a/cc_bindings_from_rs/generate_bindings/generate_function_test.rs
+++ b/cc_bindings_from_rs/generate_bindings/generate_function_test.rs
@@ -1182,7 +1182,7 @@ fn test_format_item_fn_rust_abi_returning_struct_by_value() {
             result.cc_details.tokens,
             quote! {
                 namespace __crubit_internal {
-                    extern "C" void ...(::std::int32_t, ::rust_out::S* __ret_ptr);
+                    extern "C" void ...(::std::int32_t, ::rust_out::S* crubit_nonnull __ret_ptr);
                 }
                 ...
                 inline ::rust_out::S create(::std::int32_t i) {
diff --git a/cc_bindings_from_rs/generate_bindings/generate_function_thunk.rs b/cc_bindings_from_rs/generate_bindings/generate_function_thunk.rs
index b0f10ce52..cf773bc26 100644
--- a/cc_bindings_from_rs/generate_bindings/generate_function_thunk.rs
+++ b/cc_bindings_from_rs/generate_bindings/generate_function_thunk.rs
@@ -181,30 +181,36 @@ pub fn generate_thunk_decl<'tcx>(
     // We should centralize this logic so that the order exists in a singular location used by both
     // places.
     let thunk_ret_type = if is_constructor && is_bridged_layout_compat_type(db, sig_mid.output()) {
-        thunk_params.push(quote! { #main_api_ret_type* __ret_ptr });
+        prereqs.includes.insert(db.support_header("annotations_internal.h"));
+        thunk_params.push(quote! { #main_api_ret_type* crubit_nonnull __ret_ptr });
         quote! { void }
     } else if let Some(briging) = is_bridged_type(db, sig_mid.output())? {
         match briging {
             BridgedType::Legacy { .. } => {
-                thunk_params.push(quote! { #main_api_ret_type* __ret_ptr });
+                prereqs.includes.insert(db.support_header("annotations_internal.h"));
+                thunk_params.push(quote! { #main_api_ret_type* crubit_nonnull __ret_ptr });
                 quote! { void }
             }
             BridgedType::Composable(_) => {
-                thunk_params.push(quote! { unsigned char * __ret_ptr });
+                prereqs.includes.insert(db.support_header("annotations_internal.h"));
+                thunk_params.push(quote! { unsigned char * crubit_nonnull __ret_ptr });
                 quote! { void }
             }
         }
     } else if is_c_abi_compatible_by_value(tcx, sig_mid.output()) {
         main_api_ret_type
     } else if let Some(tuple_abi) = tuple_c_abi_c_type(db, sig_mid.output()) {
-        thunk_params.push(quote! { #tuple_abi __ret_ptr });
+        prereqs.includes.insert(db.support_header("annotations_internal.h"));
+        thunk_params.push(quote! { #tuple_abi crubit_nonnull __ret_ptr });
         quote! { void }
     } else if let ty::TyKind::Array(inner_ty, _) = sig_mid.output().kind() {
         let c_type = array_c_abi_c_type(db.tcx(), *inner_ty)?;
-        thunk_params.push(quote! { #c_type __ret_ptr });
+        prereqs.includes.insert(db.support_header("annotations_internal.h"));
+        thunk_params.push(quote! { #c_type crubit_nonnull __ret_ptr });
         quote! { void }
     } else {
-        thunk_params.push(quote! { #main_api_ret_type* __ret_ptr });
+        prereqs.includes.insert(db.support_header("annotations_internal.h"));
+        thunk_params.push(quote! { #main_api_ret_type* crubit_nonnull __ret_ptr });
         quote! { void }
     };
 
diff --git a/cc_bindings_from_rs/test/aliasing_references/aliasing_references_cc_api.h b/cc_bindings_from_rs/test/aliasing_references/aliasing_references_cc_api.h
index d89279b52..81aa84091 100644
--- a/cc_bindings_from_rs/test/aliasing_references/aliasing_references_cc_api.h
+++ b/cc_bindings_from_rs/test/aliasing_references/aliasing_references_cc_api.h
@@ -126,7 +126,7 @@ static_assert(
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    ::aliasing_references::NonFreezeType* __ret_ptr);
+    ::aliasing_references::NonFreezeType* crubit_nonnull __ret_ptr);
 }
 inline ::aliasing_references::NonFreezeType::NonFreezeType() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -167,7 +167,7 @@ static_assert(
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    ::aliasing_references::SomeStruct* __ret_ptr);
+    ::aliasing_references::SomeStruct* crubit_nonnull __ret_ptr);
 }
 inline ::aliasing_references::SomeStruct::SomeStruct() {
   __crubit_internal::__crubit_thunk_default(this);
diff --git a/cc_bindings_from_rs/test/arrays/arrays_cc_api.h b/cc_bindings_from_rs/test/arrays/arrays_cc_api.h
index e4bb22cac..0bb7fb690 100644
--- a/cc_bindings_from_rs/test/arrays/arrays_cc_api.h
+++ b/cc_bindings_from_rs/test/arrays/arrays_cc_api.h
@@ -128,8 +128,9 @@ function_with_array_tuple_id(::std::tuple<::std::array<::std::int32_t, 2>,
                                  array_tup);
 
 // CRUBIT_ANNOTATE: must_bind=
-::std::array<::std::int32_t, 2> const* function_with_const_array_ptr_id(
-    ::std::array<::std::int32_t, 2> const* array_ptr);
+::std::array<::std::int32_t, 2> const* crubit_nullability_unknown
+function_with_const_array_ptr_id(::std::array<::std::int32_t, 2> const*
+                                     crubit_nullability_unknown array_ptr);
 
 // CRUBIT_ANNOTATE: must_bind=
 ::std::array<::std::int32_t, 0> function_with_empty_array(
@@ -148,9 +149,10 @@ ::std::array<::arrays::HasDrop, 2> function_with_has_drop_array_id(
 ::std::array<::arrays::HasDrop, 2> function_with_has_drop_ret_only();
 
 // CRUBIT_ANNOTATE: must_bind=
-::std::array<::std::int32_t, 3> const*
+::std::array<::std::int32_t, 3> const* crubit_nullability_unknown
 function_with_mut_array_named_size_ptr_id(
-    ::std::array<::std::int32_t, 3> const* array_ptr);
+    ::std::array<::std::int32_t, 3> const* crubit_nullability_unknown
+        array_ptr);
 
 // CRUBIT_ANNOTATE: must_bind=
 ::std::array<::std::array<::std::int32_t, 2>, 2> function_with_nested_arrays(
@@ -216,7 +218,8 @@ static_assert(
     alignof(ArrayStruct) == 4,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::arrays::ArrayStruct* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::arrays::ArrayStruct* crubit_nonnull __ret_ptr);
 }
 inline ::arrays::ArrayStruct::ArrayStruct() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -241,7 +244,7 @@ extern "C" void __crubit_thunk_drop(::arrays::HasDrop&);
 inline HasDrop::~HasDrop() { __crubit_internal::__crubit_thunk_drop(*this); }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_new(::std::int32_t,
-                                   ::arrays::HasDrop* __ret_ptr);
+                                   ::arrays::HasDrop* crubit_nonnull __ret_ptr);
 }
 inline ::arrays::HasDrop HasDrop::new_(::std::int32_t x) {
   crubit::Slot<::arrays::HasDrop> __return_value_ret_val_holder;
@@ -259,7 +262,8 @@ static_assert(
     alignof(HasDropAndDefault) == 4,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::arrays::HasDropAndDefault* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::arrays::HasDropAndDefault* crubit_nonnull __ret_ptr);
 }
 inline ::arrays::HasDropAndDefault::HasDropAndDefault() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -283,8 +287,8 @@ inline void HasDropAndDefault::__crubit_field_offset_assertions() {
   static_assert(0 == offsetof(HasDropAndDefault, x));
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_function_uwith_uarray_uid(void*,
-                                                         void* __ret_ptr);
+extern "C" void __crubit_thunk_function_uwith_uarray_uid(
+    void*, void* crubit_nonnull __ret_ptr);
 }
 inline ::std::array<::std::int32_t, 2> function_with_array_id(
     ::std::array<::std::int32_t, 2> array) {
@@ -297,7 +301,7 @@ inline ::std::array<::std::int32_t, 2> function_with_array_id(
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_function_uwith_uarray_ustruct_uid(
-    ::arrays::ArrayStruct*, ::arrays::ArrayStruct* __ret_ptr);
+    ::arrays::ArrayStruct*, ::arrays::ArrayStruct* crubit_nonnull __ret_ptr);
 }
 inline ::arrays::ArrayStruct function_with_array_struct_id(
     ::arrays::ArrayStruct array_struct) {
@@ -310,7 +314,7 @@ inline ::arrays::ArrayStruct function_with_array_struct_id(
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_function_uwith_uarray_utuple_uid(
-    void**, void** __ret_ptr);
+    void**, void** crubit_nonnull __ret_ptr);
 }
 inline ::std::tuple<::std::array<::std::int32_t, 2>,
                     ::std::array<::std::int32_t, 2>>
@@ -336,19 +340,20 @@ function_with_array_tuple_id(::std::tuple<::std::array<::std::int32_t, 2>,
 }
 
 namespace __crubit_internal {
-extern "C" ::std::array<::std::int32_t, 2> const*
+extern "C" ::std::array<::std::int32_t, 2> const* crubit_nullability_unknown
 __crubit_thunk_function_uwith_uconst_uarray_uptr_uid(
-    ::std::array<::std::int32_t, 2> const*);
+    ::std::array<::std::int32_t, 2> const* crubit_nullability_unknown);
 }
-inline ::std::array<::std::int32_t, 2> const* function_with_const_array_ptr_id(
-    ::std::array<::std::int32_t, 2> const* array_ptr) {
+inline ::std::array<::std::int32_t, 2> const* crubit_nullability_unknown
+function_with_const_array_ptr_id(::std::array<::std::int32_t, 2> const*
+                                     crubit_nullability_unknown array_ptr) {
   return __crubit_internal::
       __crubit_thunk_function_uwith_uconst_uarray_uptr_uid(array_ptr);
 }
 
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_function_uwith_uempty_uarray(void*,
-                                                            void* __ret_ptr);
+extern "C" void __crubit_thunk_function_uwith_uempty_uarray(
+    void*, void* crubit_nonnull __ret_ptr);
 }
 inline ::std::array<::std::int32_t, 0> function_with_empty_array(
     ::std::array<::std::int32_t, 0> array) {
@@ -362,7 +367,7 @@ inline ::std::array<::std::int32_t, 0> function_with_empty_array(
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_function_uwith_uhas_udrop_uand_udefault_uarray_uid(
-    void*, void* __ret_ptr);
+    void*, void* crubit_nonnull __ret_ptr);
 }
 inline ::std::array<::arrays::HasDropAndDefault, 2>
 function_with_has_drop_and_default_array_id(
@@ -379,7 +384,7 @@ function_with_has_drop_and_default_array_id(
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_function_uwith_uhas_udrop_uarray_uid(
-    void*, void* __ret_ptr);
+    void*, void* crubit_nonnull __ret_ptr);
 }
 inline ::std::array<::arrays::HasDrop, 2> function_with_has_drop_array_id(
     ::std::array<::arrays::HasDrop, 2> array) {
@@ -394,7 +399,7 @@ inline ::std::array<::arrays::HasDrop, 2> function_with_has_drop_array_id(
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_function_uwith_uhas_udrop_uret_uonly(
-    void* __ret_ptr);
+    void* crubit_nonnull __ret_ptr);
 }
 inline ::std::array<::arrays::HasDrop, 2> function_with_has_drop_ret_only() {
   crubit::Slot<::std::array<::arrays::HasDrop, 2>>
@@ -406,21 +411,22 @@ inline ::std::array<::arrays::HasDrop, 2> function_with_has_drop_ret_only() {
 }
 
 namespace __crubit_internal {
-extern "C" ::std::array<::std::int32_t, 3> const*
+extern "C" ::std::array<::std::int32_t, 3> const* crubit_nullability_unknown
 __crubit_thunk_function_uwith_umut_uarray_unamed_usize_uptr_uid(
-    ::std::array<::std::int32_t, 3> const*);
+    ::std::array<::std::int32_t, 3> const* crubit_nullability_unknown);
 }
-inline ::std::array<::std::int32_t, 3> const*
+inline ::std::array<::std::int32_t, 3> const* crubit_nullability_unknown
 function_with_mut_array_named_size_ptr_id(
-    ::std::array<::std::int32_t, 3> const* array_ptr) {
+    ::std::array<::std::int32_t, 3> const* crubit_nullability_unknown
+        array_ptr) {
   return __crubit_internal::
       __crubit_thunk_function_uwith_umut_uarray_unamed_usize_uptr_uid(
           array_ptr);
 }
 
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_function_uwith_unested_uarrays(void*,
-                                                              void* __ret_ptr);
+extern "C" void __crubit_thunk_function_uwith_unested_uarrays(
+    void*, void* crubit_nonnull __ret_ptr);
 }
 inline ::std::array<::std::array<::std::int32_t, 2>, 2>
 function_with_nested_arrays(
@@ -435,7 +441,7 @@ function_with_nested_arrays(
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_function_uwith_unested_udrop_udefault_uarrays(
-    void*, void* __ret_ptr);
+    void*, void* crubit_nonnull __ret_ptr);
 }
 inline ::std::array<::std::array<::arrays::HasDropAndDefault, 2>, 2>
 function_with_nested_drop_default_arrays(
@@ -452,7 +458,7 @@ function_with_nested_drop_default_arrays(
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_function_uwith_utuple_uarray_uid(
-    void*, void* __ret_ptr);
+    void*, void* crubit_nonnull __ret_ptr);
 }
 inline ::std::array<rs_std::Tuple<::std::int32_t, ::std::int32_t>, 2>
 function_with_tuple_array_id(
@@ -471,7 +477,7 @@ function_with_tuple_array_id(
 #define _CRUBIT_BINDINGS_FOR_IMPL__x0000003a_x0000003a_x00000020rs_ustd_x00000020_x0000003a_x0000003a_x00000020Tuple_x00000020_x0000003c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020int32_ut_x00000020_x0000002c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020int32_ut_x00000020_x0000003e
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    rs_std::Tuple<::std::int32_t, ::std::int32_t>* __ret_ptr);
+    rs_std::Tuple<::std::int32_t, ::std::int32_t>* crubit_nonnull __ret_ptr);
 }
 inline ::rs_std::Tuple<::std::int32_t, ::std::int32_t>::Tuple() {
   __crubit_internal::__crubit_thunk_default(this);
diff --git a/cc_bindings_from_rs/test/attribute/cpp_name_cc_api.h b/cc_bindings_from_rs/test/attribute/cpp_name_cc_api.h
index 10b22cb98..2c3ae4920 100644
--- a/cc_bindings_from_rs/test/attribute/cpp_name_cc_api.h
+++ b/cc_bindings_from_rs/test/attribute/cpp_name_cc_api.h
@@ -65,7 +65,8 @@ static_assert(::std::is_trivially_destructible_v<Replaced>);
 static_assert(::std::is_trivially_move_constructible_v<::cpp_name::Replaced>);
 static_assert(::std::is_trivially_move_assignable_v<::cpp_name::Replaced>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::cpp_name::Replaced* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::cpp_name::Replaced* crubit_nonnull __ret_ptr);
 }
 inline ::cpp_name::Replaced Replaced::create() {
   crubit::Slot<::cpp_name::Replaced> __return_value_ret_val_holder;
diff --git a/cc_bindings_from_rs/test/attribute/must_bind_cc_api.h b/cc_bindings_from_rs/test/attribute/must_bind_cc_api.h
index b3c74d181..42bdfcf61 100644
--- a/cc_bindings_from_rs/test/attribute/must_bind_cc_api.h
+++ b/cc_bindings_from_rs/test/attribute/must_bind_cc_api.h
@@ -68,7 +68,8 @@ static_assert(::std::is_trivially_destructible_v<Original>);
 static_assert(::std::is_trivially_move_constructible_v<::must_bind::Original>);
 static_assert(::std::is_trivially_move_assignable_v<::must_bind::Original>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::must_bind::Original* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::must_bind::Original* crubit_nonnull __ret_ptr);
 }
 inline ::must_bind::Original Original::new_() {
   crubit::Slot<::must_bind::Original> __return_value_ret_val_holder;
diff --git a/cc_bindings_from_rs/test/bridging/bridged_types_cc_api.h b/cc_bindings_from_rs/test/bridging/bridged_types_cc_api.h
index e6170984b..c79f56ef1 100644
--- a/cc_bindings_from_rs/test/bridging/bridged_types_cc_api.h
+++ b/cc_bindings_from_rs/test/bridging/bridged_types_cc_api.h
@@ -14,6 +14,8 @@
 #pragma clang diagnostic ignored "-Wunused-private-field"
 #pragma clang diagnostic ignored "-Wdeprecated-declarations"
 #pragma clang diagnostic ignored "-Wignored-attributes"
+#include "support/annotations_internal.h"
+
 #include "cpp_ns/cpp_type.h"
 
 namespace bridged_types::test_format_bridged_func_arg_by_pointer {
@@ -102,7 +104,7 @@ namespace bridged_types::test_format_bridged_return_type_by_pointer {
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_test_uformat_ubridged_ureturn_utype_uby_upointer(
-    CppType** __ret_ptr);
+    CppType** crubit_nonnull __ret_ptr);
 }
 inline CppType* test_format_bridged_return_type_by_pointer() {
   union __return_value_crubit_return_union {
@@ -123,7 +125,7 @@ namespace bridged_types::test_format_bridged_return_type_by_value {
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_test_uformat_ubridged_ureturn_utype_uby_uvalue(
-    cpp_ns::CppType* __ret_ptr);
+    cpp_ns::CppType* crubit_nonnull __ret_ptr);
 }
 inline cpp_ns::CppType test_format_bridged_return_type_by_value() {
   union __return_value_crubit_return_union {
diff --git a/cc_bindings_from_rs/test/bridging/layout_equivalent_generics_cc_api.h b/cc_bindings_from_rs/test/bridging/layout_equivalent_generics_cc_api.h
index c5e29d824..1767bb905 100644
--- a/cc_bindings_from_rs/test/bridging/layout_equivalent_generics_cc_api.h
+++ b/cc_bindings_from_rs/test/bridging/layout_equivalent_generics_cc_api.h
@@ -136,7 +136,7 @@ inline bool accept_status_or_unit(crubit::test::MyStatus status) {
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create_ubool_ubool_upair(
-    crubit::test::MyPair<bool, bool>* __ret_ptr);
+    crubit::test::MyPair<bool, bool>* crubit_nonnull __ret_ptr);
 }
 inline crubit::test::MyPair<bool, bool> create_bool_bool_pair() {
   union __return_value_crubit_return_union {
@@ -152,7 +152,7 @@ inline crubit::test::MyPair<bool, bool> create_bool_bool_pair() {
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create_uint_ubool_upair(
-    crubit::test::MyIntBoolPair* __ret_ptr);
+    crubit::test::MyIntBoolPair* crubit_nonnull __ret_ptr);
 }
 inline crubit::test::MyIntBoolPair create_int_bool_pair() {
   union __return_value_crubit_return_union {
@@ -168,7 +168,7 @@ inline crubit::test::MyIntBoolPair create_int_bool_pair() {
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create_ustatus_uwith_uprivate_usecret(
-    crubit::test::MyStatus* __ret_ptr);
+    crubit::test::MyStatus* crubit_nonnull __ret_ptr);
 }
 inline crubit::test::MyStatus create_status_with_private_secret() {
   union __return_value_crubit_return_union {
@@ -184,7 +184,7 @@ inline crubit::test::MyStatus create_status_with_private_secret() {
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create_ustatus_uwith_usecret(
-    crubit::test::MyStatus* __ret_ptr);
+    crubit::test::MyStatus* crubit_nonnull __ret_ptr);
 }
 inline crubit::test::MyStatus create_status_with_secret() {
   union __return_value_crubit_return_union {
@@ -200,7 +200,7 @@ inline crubit::test::MyStatus create_status_with_secret() {
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create_ustatus_uwith_usecret_ualias(
-    crubit::test::MyStatus* __ret_ptr);
+    crubit::test::MyStatus* crubit_nonnull __ret_ptr);
 }
 inline crubit::test::MyStatus create_status_with_secret_alias() {
   union __return_value_crubit_return_union {
@@ -223,7 +223,8 @@ inline bool is_ok_secret(crubit::test::MyStatus status) {
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_return_uoptional_uby_uvalue(
-    ::std::int32_t, crubit::test::MyOptional<::std::int32_t>* __ret_ptr);
+    ::std::int32_t,
+    crubit::test::MyOptional<::std::int32_t>* crubit_nonnull __ret_ptr);
 }
 inline crubit::test::MyOptional<::std::int32_t> return_optional_by_value(
     ::std::int32_t x) {
@@ -240,7 +241,7 @@ inline crubit::test::MyOptional<::std::int32_t> return_optional_by_value(
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_return_ustatus(
-    crubit::test::MyStatus* __ret_ptr);
+    crubit::test::MyStatus* crubit_nonnull __ret_ptr);
 }
 inline crubit::test::MyStatus return_status() {
   union __return_value_crubit_return_union {
@@ -255,7 +256,7 @@ inline crubit::test::MyStatus return_status() {
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_return_ustatus_ualias(
-    crubit::test::MyStatus* __ret_ptr);
+    crubit::test::MyStatus* crubit_nonnull __ret_ptr);
 }
 inline crubit::test::MyStatus return_status_alias() {
   union __return_value_crubit_return_union {
@@ -272,7 +273,7 @@ inline crubit::test::MyStatus return_status_alias() {
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_return_ustatus_unon_uunit(
     crubit::test::MyStatusOr<::std::uint32_t>*,
-    crubit::test::MyStatusOr<::std::uint64_t>* __ret_ptr);
+    crubit::test::MyStatusOr<::std::uint64_t>* crubit_nonnull __ret_ptr);
 }
 inline crubit::test::MyStatusOr<::std::uint64_t> return_status_non_unit(
     crubit::test::MyStatusOr<::std::uint32_t> status) {
@@ -289,7 +290,7 @@ inline crubit::test::MyStatusOr<::std::uint64_t> return_status_non_unit(
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_return_ustatus_uor_uunit(
-    crubit::test::MyStatus* __ret_ptr);
+    crubit::test::MyStatus* crubit_nonnull __ret_ptr);
 }
 inline crubit::test::MyStatus return_status_or_unit() {
   union __return_value_crubit_return_union {
@@ -305,7 +306,7 @@ inline crubit::test::MyStatus return_status_or_unit() {
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_return_ustatus_uor_uunit_ualias(
-    crubit::test::MyStatus* __ret_ptr);
+    crubit::test::MyStatus* crubit_nonnull __ret_ptr);
 }
 inline crubit::test::MyStatus return_status_or_unit_alias() {
   union __return_value_crubit_return_union {
diff --git a/cc_bindings_from_rs/test/bridging/layout_equivalent_pointers_cc_api.h b/cc_bindings_from_rs/test/bridging/layout_equivalent_pointers_cc_api.h
index f4b543b1b..cb06be219 100644
--- a/cc_bindings_from_rs/test/bridging/layout_equivalent_pointers_cc_api.h
+++ b/cc_bindings_from_rs/test/bridging/layout_equivalent_pointers_cc_api.h
@@ -14,6 +14,8 @@
 #pragma clang diagnostic ignored "-Wunused-private-field"
 #pragma clang diagnostic ignored "-Wdeprecated-declarations"
 #pragma clang diagnostic ignored "-Wignored-attributes"
+#include "support/annotations_internal.h"
+
 #include "cpp_ns/cpp_type.h"
 
 namespace layout_equivalent_pointers::test_format_func_arg_pointer_like {
@@ -61,7 +63,7 @@ namespace layout_equivalent_pointers::test_format_return_type_pointer_like {
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_test_uformat_ureturn_utype_upointer_ulike(
-    CppType** __ret_ptr);
+    CppType** crubit_nonnull __ret_ptr);
 }
 inline CppType* test_format_return_type_pointer_like() {
   union __return_value_crubit_return_union {
diff --git a/cc_bindings_from_rs/test/bridging/protobuf/rust_lib_cc_api.h b/cc_bindings_from_rs/test/bridging/protobuf/rust_lib_cc_api.h
index ec82e8c97..e18b92c2f 100644
--- a/cc_bindings_from_rs/test/bridging/protobuf/rust_lib_cc_api.h
+++ b/cc_bindings_from_rs/test/bridging/protobuf/rust_lib_cc_api.h
@@ -77,7 +77,8 @@ static_assert(
     alignof(FooService) == 8,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::rust_lib::FooService* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::rust_lib::FooService* crubit_nonnull __ret_ptr);
 }
 inline ::rust_lib::FooService::FooService() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -110,7 +111,7 @@ inline bool FooService::handle_request(const ::foo_service::FooRequest* req,
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_request_ustats(
     ::rust_lib::FooService const&,
-    const ::foo_service::FooRequestStats** __ret_ptr);
+    const ::foo_service::FooRequestStats** crubit_nonnull __ret_ptr);
 }
 inline const ::foo_service::FooRequestStats* FooService::request_stats()
     const& $(__anon1) CRUBIT_LIFETIME_BOUND {
@@ -128,7 +129,8 @@ inline const ::foo_service::FooRequestStats* FooService::request_stats()
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_urequest_ustats(
-    ::rust_lib::FooService const&, ::foo_service::FooRequestStats* __ret_ptr);
+    ::rust_lib::FooService const&,
+    ::foo_service::FooRequestStats* crubit_nonnull __ret_ptr);
 }
 inline ::foo_service::FooRequestStats FooService::clone_request_stats() const {
   auto&& self = *this;
diff --git a/cc_bindings_from_rs/test/enums/enums_cc_api.h b/cc_bindings_from_rs/test/enums/enums_cc_api.h
index 16552365a..b8bde496b 100644
--- a/cc_bindings_from_rs/test/enums/enums_cc_api.h
+++ b/cc_bindings_from_rs/test/enums/enums_cc_api.h
@@ -595,7 +595,7 @@ struct CRUBIT_INTERNAL_RUST_TYPE(
   }
   struct alignas(0) __crubit_A_struct {
    public:
-    ::std::int32_t* p;
+    ::std::int32_t* crubit_nullability_unknown p;
   };
 
   enum class Tag : ::std::int8_t {
@@ -665,7 +665,7 @@ struct CRUBIT_INTERNAL_RUST_TYPE(
 
   struct alignas(0) __crubit_C_struct {
    public:
-    ::std::int32_t* p;
+    ::std::int32_t* crubit_nullability_unknown p;
   };
 
   enum class Tag : ::std::uint32_t {
@@ -1113,7 +1113,7 @@ inline constexpr QrError QrError::MakeInvalidCharacter() {
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_Structured(
     ::enums::qr_error::StructuredQrError*,
-    ::enums::qr_error::QrError* __ret_ptr);
+    ::enums::qr_error::QrError* crubit_nonnull __ret_ptr);
 }
 inline ::enums::qr_error::QrError QrError::MakeStructured(
     ::enums::qr_error::StructuredQrError __param_0) {
@@ -1171,7 +1171,8 @@ inline constexpr StructuredQrError StructuredQrError::MakeAtLeast2Pieces() {
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_TotalMismatch(
-    ::std::uintptr_t, ::enums::qr_error::StructuredQrError* __ret_ptr);
+    ::std::uintptr_t,
+    ::enums::qr_error::StructuredQrError* crubit_nonnull __ret_ptr);
 }
 inline ::enums::qr_error::StructuredQrError
 StructuredQrError::MakeTotalMismatch(::std::uintptr_t __param_0) {
@@ -1222,7 +1223,7 @@ inline constexpr StructuredQrError StructuredQrError::MakeStructuredWrongEnc() {
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_SeqGreaterThanTotal(
     ::std::uint8_t, ::std::uint8_t,
-    ::enums::qr_error::StructuredQrError* __ret_ptr);
+    ::enums::qr_error::StructuredQrError* crubit_nonnull __ret_ptr);
 }
 inline ::enums::qr_error::StructuredQrError
 StructuredQrError::MakeSeqGreaterThanTotal(::std::uint8_t __param_0,
@@ -1238,7 +1239,7 @@ StructuredQrError::MakeSeqGreaterThanTotal(::std::uint8_t __param_0,
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_LengthMismatch(
     ::std::uintptr_t, ::std::uintptr_t,
-    ::enums::qr_error::StructuredQrError* __ret_ptr);
+    ::enums::qr_error::StructuredQrError* crubit_nonnull __ret_ptr);
 }
 inline ::enums::qr_error::StructuredQrError
 StructuredQrError::MakeLengthMismatch(::std::uintptr_t __param_0,
@@ -1253,7 +1254,8 @@ StructuredQrError::MakeLengthMismatch(::std::uintptr_t __param_0,
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_UnsupportedVersion(
-    ::std::int16_t, ::enums::qr_error::StructuredQrError* __ret_ptr);
+    ::std::int16_t,
+    ::enums::qr_error::StructuredQrError* crubit_nonnull __ret_ptr);
 }
 inline ::enums::qr_error::StructuredQrError
 StructuredQrError::MakeUnsupportedVersion(::std::int16_t __param_0) {
@@ -1267,7 +1269,8 @@ StructuredQrError::MakeUnsupportedVersion(::std::int16_t __param_0) {
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_SplitMax16(
-    ::std::uintptr_t, ::enums::qr_error::StructuredQrError* __ret_ptr);
+    ::std::uintptr_t,
+    ::enums::qr_error::StructuredQrError* crubit_nonnull __ret_ptr);
 }
 inline ::enums::qr_error::StructuredQrError StructuredQrError::MakeSplitMax16(
     ::std::uintptr_t __param_0) {
@@ -1401,14 +1404,16 @@ static_assert(
     alignof(MyEnum) == 8,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::enums::repr_c::MyEnum* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::enums::repr_c::MyEnum* crubit_nonnull __ret_ptr);
 }
 inline ::enums::repr_c::MyEnum::MyEnum() {
   __crubit_internal::__crubit_thunk_default(this);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_E(::rs::alloc::string::String*, ::std::int32_t,
-                                 ::enums::repr_c::MyEnum* __ret_ptr);
+                                 ::enums::repr_c::MyEnum* crubit_nonnull
+                                     __ret_ptr);
 }
 inline ::enums::repr_c::MyEnum MyEnum::MakeE(
     ::rs::alloc::string::String __param_0, ::std::int32_t __param_1) {
@@ -1422,7 +1427,8 @@ inline ::enums::repr_c::MyEnum MyEnum::MakeE(
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_A(::std::int32_t, ::std::int64_t,
-                                 ::enums::repr_c::MyEnum* __ret_ptr);
+                                 ::enums::repr_c::MyEnum* crubit_nonnull
+                                     __ret_ptr);
 }
 inline ::enums::repr_c::MyEnum MyEnum::MakeA(::std::int32_t __param_0,
                                              ::std::int64_t __param_1) {
@@ -1588,7 +1594,8 @@ static_assert(
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    ::enums::repr_c_clone_active_variant::CloneActiveVariant* __ret_ptr);
+    ::enums::repr_c_clone_active_variant::CloneActiveVariant* crubit_nonnull
+        __ret_ptr);
 }
 inline ::enums::repr_c_clone_active_variant::CloneActiveVariant::
     CloneActiveVariant() {
@@ -1597,7 +1604,8 @@ inline ::enums::repr_c_clone_active_variant::CloneActiveVariant::
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_A(
     ::std::int32_t,
-    ::enums::repr_c_clone_active_variant::CloneActiveVariant* __ret_ptr);
+    ::enums::repr_c_clone_active_variant::CloneActiveVariant* crubit_nonnull
+        __ret_ptr);
 }
 inline ::enums::repr_c_clone_active_variant::CloneActiveVariant
 CloneActiveVariant::MakeA(::std::int32_t __param_0) {
@@ -1611,7 +1619,8 @@ CloneActiveVariant::MakeA(::std::int32_t __param_0) {
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_B(
     ::std::int32_t,
-    ::enums::repr_c_clone_active_variant::CloneActiveVariant* __ret_ptr);
+    ::enums::repr_c_clone_active_variant::CloneActiveVariant* crubit_nonnull
+        __ret_ptr);
 }
 inline ::enums::repr_c_clone_active_variant::CloneActiveVariant
 CloneActiveVariant::MakeB(::std::int32_t __param_0) {
@@ -1625,7 +1634,8 @@ CloneActiveVariant::MakeB(::std::int32_t __param_0) {
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_C(
     ::std::int32_t,
-    ::enums::repr_c_clone_active_variant::CloneActiveVariant* __ret_ptr);
+    ::enums::repr_c_clone_active_variant::CloneActiveVariant* crubit_nonnull
+        __ret_ptr);
 }
 inline ::enums::repr_c_clone_active_variant::CloneActiveVariant
 CloneActiveVariant::MakeC(::std::int32_t __param_0) {
@@ -1643,7 +1653,8 @@ static_assert(::std::is_trivially_move_assignable_v<
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone(
     ::enums::repr_c_clone_active_variant::CloneActiveVariant const&,
-    ::enums::repr_c_clone_active_variant::CloneActiveVariant* __ret_ptr);
+    ::enums::repr_c_clone_active_variant::CloneActiveVariant* crubit_nonnull
+        __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(
@@ -1709,7 +1720,7 @@ static_assert(
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    ::enums::repr_c_clone_counter::CloneCount* __ret_ptr);
+    ::enums::repr_c_clone_counter::CloneCount* crubit_nonnull __ret_ptr);
 }
 inline ::enums::repr_c_clone_counter::CloneCount::CloneCount() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -1722,7 +1733,7 @@ static_assert(::std::is_trivially_move_assignable_v<
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone(
     ::enums::repr_c_clone_counter::CloneCount const&,
-    ::enums::repr_c_clone_counter::CloneCount* __ret_ptr);
+    ::enums::repr_c_clone_counter::CloneCount* crubit_nonnull __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(
@@ -1755,14 +1766,15 @@ static_assert(
     alignof(DropMe) == 8,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::enums::repr_c_drop::DropMe* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::enums::repr_c_drop::DropMe* crubit_nonnull __ret_ptr);
 }
 inline ::enums::repr_c_drop::DropMe::DropMe() {
   __crubit_internal::__crubit_thunk_default(this);
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_A(::std::int32_t,
-                                 ::enums::repr_c_drop::DropMe* __ret_ptr);
+extern "C" void __crubit_thunk_A(
+    ::std::int32_t, ::enums::repr_c_drop::DropMe* crubit_nonnull __ret_ptr);
 }
 inline ::enums::repr_c_drop::DropMe DropMe::MakeA(::std::int32_t __param_0) {
   crubit::Slot<::enums::repr_c_drop::DropMe> __return_value_ret_val_holder;
@@ -1772,8 +1784,8 @@ inline ::enums::repr_c_drop::DropMe DropMe::MakeA(::std::int32_t __param_0) {
 }
 
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_B(::std::int64_t,
-                                 ::enums::repr_c_drop::DropMe* __ret_ptr);
+extern "C" void __crubit_thunk_B(
+    ::std::int64_t, ::enums::repr_c_drop::DropMe* crubit_nonnull __ret_ptr);
 }
 inline ::enums::repr_c_drop::DropMe DropMe::MakeB(::std::int64_t __param_0) {
   crubit::Slot<::enums::repr_c_drop::DropMe> __return_value_ret_val_holder;
@@ -1955,7 +1967,7 @@ inline constexpr RustReprEnum RustReprEnum::MakeVariant3() {
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_TuplePayloadVariant(
     ::std::int32_t, ::std::int32_t,
-    ::enums::repr_rust::RustReprEnum* __ret_ptr);
+    ::enums::repr_rust::RustReprEnum* crubit_nonnull __ret_ptr);
 }
 inline ::enums::repr_rust::RustReprEnum RustReprEnum::MakeTuplePayloadVariant(
     ::std::int32_t __param_0, ::std::int32_t __param_1) {
@@ -2017,7 +2029,7 @@ static_assert(
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_MakeNoPayloadVariant(
     ::enums::repr_rust::RustReprWithNamingConflictBetweenCtorsAndMethods*
-        __ret_ptr);
+        crubit_nonnull __ret_ptr);
 }
 inline ::enums::repr_rust::RustReprWithNamingConflictBetweenCtorsAndMethods
 RustReprWithNamingConflictBetweenCtorsAndMethods::MakeNoPayloadVariant() {
@@ -2034,7 +2046,7 @@ namespace __crubit_internal {
 extern "C" void __crubit_thunk_MakeTuplePayloadVariant(
     ::std::int32_t,
     ::enums::repr_rust::RustReprWithNamingConflictBetweenCtorsAndMethods*
-        __ret_ptr);
+        crubit_nonnull __ret_ptr);
 }
 inline ::enums::repr_rust::RustReprWithNamingConflictBetweenCtorsAndMethods
 RustReprWithNamingConflictBetweenCtorsAndMethods::MakeTuplePayloadVariant(
@@ -2052,7 +2064,7 @@ namespace __crubit_internal {
 extern "C" void __crubit_thunk_MakeStructPayloadVariant(
     ::std::int32_t,
     ::enums::repr_rust::RustReprWithNamingConflictBetweenCtorsAndMethods*
-        __ret_ptr);
+        crubit_nonnull __ret_ptr);
 }
 inline ::enums::repr_rust::RustReprWithNamingConflictBetweenCtorsAndMethods
 RustReprWithNamingConflictBetweenCtorsAndMethods::MakeStructPayloadVariant(
@@ -2102,7 +2114,8 @@ static_assert(
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_SingleVariant(
     ::std::int32_t,
-    ::enums::repr_rust::RustReprWithSingleTuplePayloadVariant* __ret_ptr);
+    ::enums::repr_rust::RustReprWithSingleTuplePayloadVariant* crubit_nonnull
+        __ret_ptr);
 }
 inline ::enums::repr_rust::RustReprWithSingleTuplePayloadVariant
 RustReprWithSingleTuplePayloadVariant::MakeSingleVariant(
diff --git a/cc_bindings_from_rs/test/enums/option_cc_api.h b/cc_bindings_from_rs/test/enums/option_cc_api.h
index 21f46323e..19c1bddf2 100644
--- a/cc_bindings_from_rs/test/enums/option_cc_api.h
+++ b/cc_bindings_from_rs/test/enums/option_cc_api.h
@@ -102,7 +102,8 @@ struct CRUBIT_INTERNAL_RUST_TYPE(":: option_golden :: CopyNoDefault") alignas(1)
 };
 
 using FreeFunc CRUBIT_INTERNAL_RUST_TYPE(":: option_golden :: FreeFunc") =
-    crubit::type_identity_t<void(void*, void*)>*;
+    crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                 void* crubit_nullability_unknown)>*;
 // CRUBIT_ANNOTATE: must_bind=
 struct CRUBIT_INTERNAL_RUST_TYPE(":: option_golden :: HasDefault") alignas(8)
     [[clang::trivial_abi]] HasDefault final {
@@ -255,7 +256,8 @@ OptionWithSizeTypes final {
 // cc_bindings_from_rs/test/enums/option.rs;l=206:
 // Zero-sized types (ZSTs) are not supported (b/258259459)
 
-using Voidpf CRUBIT_INTERNAL_RUST_TYPE(":: option_golden :: Voidpf") = void*;
+using Voidpf CRUBIT_INTERNAL_RUST_TYPE(":: option_golden :: Voidpf") =
+    void* crubit_nullability_unknown;
 
 // Error generating bindings for function `option_golden::take_option_bridged`
 // defined at
@@ -266,12 +268,12 @@ using Voidpf CRUBIT_INTERNAL_RUST_TYPE(":: option_golden :: Voidpf") = void*;
 
 }  // namespace option
 
-#ifndef _CRUBIT_BINDINGS_FOR_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Option_x00000020_x0000003c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020int32_ut_x00000020const_x00000020_x0000002a_x00000020_x0000003e
-#define _CRUBIT_BINDINGS_FOR_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Option_x00000020_x0000003c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020int32_ut_x00000020const_x00000020_x0000002a_x00000020_x0000003e
+#ifndef _CRUBIT_BINDINGS_FOR_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Option_x00000020_x0000003c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020int32_ut_x00000020const_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000020_x0000003e
+#define _CRUBIT_BINDINGS_FOR_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Option_x00000020_x0000003c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020int32_ut_x00000020const_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000020_x0000003e
 template <>
 struct alignas(8)
     CRUBIT_INTERNAL_RUST_TYPE("std :: option :: Option < * const i32 >")
-        rs_std::Option<::std::int32_t const*> {
+        rs_std::Option<::std::int32_t const * crubit_nullability_unknown> {
  public:
   // Rust types that are `Copy` get trivial, `default` C++ copy constructor and
   // assignment operator.
@@ -288,19 +290,23 @@ struct alignas(8)
   constexpr explicit Option(::std::nullopt_t) noexcept;
   constexpr Option& operator=(::std::nullopt_t) noexcept;
 
-  explicit Option(::std::optional<::std::int32_t const*>&& value) noexcept;
-  Option& operator=(::std::optional<::std::int32_t const*>&& value) noexcept;
+  explicit Option(::std::optional<::std::int32_t const *
+                                  crubit_nullability_unknown>&& value) noexcept;
+  Option& operator=(
+      ::std::optional<::std::int32_t const * crubit_nullability_unknown>&&
+          value) noexcept;
 
   template <typename... Args>
   Option(::std::in_place_t, Args&&... args) noexcept;
   ~Option() noexcept = default;
-  operator ::std::optional<::std::int32_t const*>() && noexcept;
+  operator ::std::optional<::std::int32_t const *
+                           crubit_nullability_unknown>() && noexcept;
   bool has_value() const noexcept;
-  ::std::int32_t const*& operator*() &;
-  ::std::int32_t const* const& operator*() const&;
-  ::std::int32_t const*&& operator*() &&;
-  ::std::int32_t const** operator->();
-  ::std::int32_t const* const* operator->() const;
+  ::std::int32_t const * crubit_nullability_unknown & operator*() &;
+  ::std::int32_t const* crubit_nullability_unknown const& operator*() const&;
+  ::std::int32_t const * crubit_nullability_unknown && operator*() &&;
+  ::std::int32_t const * crubit_nullability_unknown * operator->();
+  ::std::int32_t const* crubit_nullability_unknown const* operator->() const;
 
  private:
   constexpr ::std::uint64_t tag() const& noexcept;
@@ -315,8 +321,9 @@ struct alignas(8)
 namespace option {
 
 // CRUBIT_ANNOTATE: must_bind=
-rs_std::Option<::std::int32_t const*> pass_option_ptr(
-    rs_std::Option<::std::int32_t const*> x);
+rs_std::Option<::std::int32_t const * crubit_nullability_unknown>
+pass_option_ptr(
+    rs_std::Option<::std::int32_t const * crubit_nullability_unknown> x);
 
 }  // namespace option
 
@@ -1132,13 +1139,14 @@ struct CRUBIT_INTERNAL_RUST_TYPE(":: option_golden :: HasHasOptions") alignas(1)
 
 }  // namespace option
 
-#ifndef _CRUBIT_BINDINGS_FOR_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Option_x00000020_x0000003c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000003e
-#define _CRUBIT_BINDINGS_FOR_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Option_x00000020_x0000003c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000003e
+#ifndef _CRUBIT_BINDINGS_FOR_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Option_x00000020_x0000003c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000003e
+#define _CRUBIT_BINDINGS_FOR_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Option_x00000020_x0000003c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000003e
 template <>
 struct alignas(8) CRUBIT_INTERNAL_RUST_TYPE(
     "std :: option :: Option < unsafe extern \"C\" fn (* mut :: core :: ffi :: "
     "c_void , * mut :: core :: ffi :: c_void) >")
-    rs_std::Option<crubit::type_identity_t<void(void*, void*)>*> {
+    rs_std::Option<crubit::type_identity_t<void(
+        void* crubit_nullability_unknown, void* crubit_nullability_unknown)>*> {
  public:
   // Rust types that are `Copy` get trivial, `default` C++ copy constructor and
   // assignment operator.
@@ -1155,24 +1163,35 @@ struct alignas(8) CRUBIT_INTERNAL_RUST_TYPE(
   constexpr explicit Option(::std::nullopt_t) noexcept;
   constexpr Option& operator=(::std::nullopt_t) noexcept;
 
-  explicit Option(
-      ::std::optional<crubit::type_identity_t<void(void*, void*)>*>&&
-          value) noexcept;
-  Option& operator=(
-      ::std::optional<crubit::type_identity_t<void(void*, void*)>*>&&
-          value) noexcept;
+  explicit Option(::std::optional<crubit::type_identity_t<void(
+                      void* crubit_nullability_unknown,
+                      void* crubit_nullability_unknown)>*>&& value) noexcept;
+  Option& operator=(::std::optional<crubit::type_identity_t<void(
+                        void* crubit_nullability_unknown,
+                        void* crubit_nullability_unknown)>*>&& value) noexcept;
 
   template <typename... Args>
   Option(::std::in_place_t, Args&&... args) noexcept;
   ~Option() noexcept = default;
-  operator ::std::optional<
-      crubit::type_identity_t<void(void*, void*)>*>() && noexcept;
+  operator ::std::optional<crubit::type_identity_t<
+      void(void* crubit_nullability_unknown,
+           void* crubit_nullability_unknown)>*>() && noexcept;
   bool has_value() const noexcept;
-  crubit::type_identity_t<void(void*, void*)>*& operator*() &;
-  crubit::type_identity_t<void(void*, void*)>* const& operator*() const&;
-  crubit::type_identity_t<void(void*, void*)>*&& operator*() &&;
-  crubit::type_identity_t<void(void*, void*)>** operator->();
-  crubit::type_identity_t<void(void*, void*)>* const* operator->() const;
+  crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                               void* crubit_nullability_unknown)>*&
+  operator*() &;
+  crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                               void* crubit_nullability_unknown)>* const&
+  operator*() const&;
+  crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                               void* crubit_nullability_unknown)>*&&
+  operator*() &&;
+  crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                               void* crubit_nullability_unknown)>**
+  operator->();
+  crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                               void* crubit_nullability_unknown)>* const*
+  operator->() const;
 
  private:
   constexpr ::std::uint64_t tag() const& noexcept;
@@ -1204,7 +1223,9 @@ struct CRUBIT_INTERNAL_RUST_TYPE(":: option_golden :: ZStream") alignas(8)
     ::std::memcpy(this, &value, sizeof(value));
   }
   union {
-    rs_std::Option<crubit::type_identity_t<void(void*, void*)>*> zfree;
+    rs_std::Option<crubit::type_identity_t<void(
+        void* crubit_nullability_unknown, void* crubit_nullability_unknown)>*>
+        zfree;
   };
 
  private:
@@ -1723,7 +1744,8 @@ static_assert(
 static_assert(::std::is_trivially_move_assignable_v<::option::CloneNoDefault>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone(::option::CloneNoDefault const&,
-                                     ::option::CloneNoDefault* __ret_ptr);
+                                     ::option::CloneNoDefault* crubit_nonnull
+                                         __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(::option::CloneNoDefault&,
@@ -1765,7 +1787,8 @@ static_assert(
     alignof(HasDefault) == 8,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::option::HasDefault* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::option::HasDefault* crubit_nonnull __ret_ptr);
 }
 inline ::option::HasDefault::HasDefault() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -1785,8 +1808,8 @@ inline ::option::HasDefault& ::option::HasDefault::operator=(
   return *this;
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(rs_std::StrRef,
-                                   ::option::HasDefault* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    rs_std::StrRef, ::option::HasDefault* crubit_nonnull __ret_ptr);
 }
 inline ::option::HasDefault HasDefault::new_(rs_std::StrRef s) {
   crubit::Slot<::option::HasDefault> __return_value_ret_val_holder;
@@ -1818,8 +1841,8 @@ static_assert(
     ::std::is_trivially_move_constructible_v<::option::HasHasOptions>);
 static_assert(::std::is_trivially_move_assignable_v<::option::HasHasOptions>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::uint8_t,
-                                   ::option::HasHasOptions* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::std::uint8_t, ::option::HasHasOptions* crubit_nonnull __ret_ptr);
 }
 inline ::option::HasHasOptions HasHasOptions::new_(::std::uint8_t value) {
   crubit::Slot<::option::HasHasOptions> __return_value_ret_val_holder;
@@ -1843,8 +1866,8 @@ inline HasNoDefault::~HasNoDefault() {
   __crubit_internal::__crubit_thunk_drop(*this);
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(rs_std::StrRef,
-                                   ::option::HasNoDefault* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    rs_std::StrRef, ::option::HasNoDefault* crubit_nonnull __ret_ptr);
 }
 inline ::option::HasNoDefault HasNoDefault::new_(rs_std::StrRef s) {
   crubit::Slot<::option::HasNoDefault> __return_value_ret_val_holder;
@@ -1876,8 +1899,8 @@ static_assert(::std::is_trivially_destructible_v<HasOptions>);
 static_assert(::std::is_trivially_move_constructible_v<::option::HasOptions>);
 static_assert(::std::is_trivially_move_assignable_v<::option::HasOptions>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::uint8_t,
-                                   ::option::HasOptions* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::std::uint8_t, ::option::HasOptions* crubit_nonnull __ret_ptr);
 }
 inline ::option::HasOptions HasOptions::new_(::std::uint8_t value) {
   crubit::Slot<::option::HasOptions> __return_value_ret_val_holder;
@@ -1888,7 +1911,8 @@ inline ::option::HasOptions HasOptions::new_(::std::uint8_t value) {
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_with_uoption(rs_std::Option<::std::uint8_t>*,
-                                            ::option::HasOptions* __ret_ptr);
+                                            ::option::HasOptions* crubit_nonnull
+                                                __ret_ptr);
 }
 inline ::option::HasOptions HasOptions::with_option(
     rs_std::Option<::std::uint8_t> value) {
@@ -1901,7 +1925,8 @@ inline ::option::HasOptions HasOptions::with_option(
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_from_uref(rs_std::Option<::std::uint8_t> const&,
-                                         ::option::HasOptions* __ret_ptr);
+                                         ::option::HasOptions* crubit_nonnull
+                                             __ret_ptr);
 }
 inline ::option::HasOptions HasOptions::from_ref(
     rs_std::Option<::std::uint8_t> const& value) {
@@ -1912,7 +1937,8 @@ inline ::option::HasOptions HasOptions::from_ref(
 }
 
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_with_unone(::option::HasOptions* __ret_ptr);
+extern "C" void __crubit_thunk_with_unone(
+    ::option::HasOptions* crubit_nonnull __ret_ptr);
 }
 inline ::option::HasOptions HasOptions::with_none() {
   crubit::Slot<::option::HasOptions> __return_value_ret_val_holder;
@@ -2038,7 +2064,8 @@ static_assert(::std::is_trivially_copy_constructible_v<::option::LessThan20U8>);
 static_assert(::std::is_trivially_copy_assignable_v<::option::LessThan20U8>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_new(
-    ::std::uint8_t, rs_std::Option<::option::LessThan20U8>* __ret_ptr);
+    ::std::uint8_t,
+    rs_std::Option<::option::LessThan20U8>* crubit_nonnull __ret_ptr);
 }
 inline rs_std::Option<::option::LessThan20U8> LessThan20U8::new_(
     ::std::uint8_t value) {
@@ -2072,7 +2099,8 @@ static_assert(
     ::std::is_trivially_move_assignable_v<::option::OptCloneNoDefault>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone(::option::OptCloneNoDefault const&,
-                                     ::option::OptCloneNoDefault* __ret_ptr);
+                                     ::option::OptCloneNoDefault* crubit_nonnull
+                                         __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(::option::OptCloneNoDefault&,
@@ -2090,8 +2118,8 @@ inline ::option::OptCloneNoDefault& ::option::OptCloneNoDefault::operator=(
   return *this;
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::uint8_t,
-                                   ::option::OptCloneNoDefault* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::std::uint8_t, ::option::OptCloneNoDefault* crubit_nonnull __ret_ptr);
 }
 inline ::option::OptCloneNoDefault OptCloneNoDefault::new_(::std::uint8_t x) {
   crubit::Slot<::option::OptCloneNoDefault> __return_value_ret_val_holder;
@@ -2118,8 +2146,8 @@ static_assert(
 static_assert(
     ::std::is_trivially_copy_assignable_v<::option::OptCopyNoDefault>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::uint8_t,
-                                   ::option::OptCopyNoDefault* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::std::uint8_t, ::option::OptCopyNoDefault* crubit_nonnull __ret_ptr);
 }
 inline ::option::OptCopyNoDefault OptCopyNoDefault::new_(::std::uint8_t x) {
   crubit::Slot<::option::OptCopyNoDefault> __return_value_ret_val_holder;
@@ -2143,8 +2171,8 @@ inline OptDefaultWithDrop::~OptDefaultWithDrop() {
   __crubit_internal::__crubit_thunk_drop(*this);
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(rs_std::StrRef,
-                                   ::option::OptDefaultWithDrop* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    rs_std::StrRef, ::option::OptDefaultWithDrop* crubit_nonnull __ret_ptr);
 }
 inline ::option::OptDefaultWithDrop OptDefaultWithDrop::new_(rs_std::StrRef s) {
   crubit::Slot<::option::OptDefaultWithDrop> __return_value_ret_val_holder;
@@ -2168,8 +2196,8 @@ inline OptNoDefaultWithDrop::~OptNoDefaultWithDrop() {
   __crubit_internal::__crubit_thunk_drop(*this);
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(rs_std::StrRef,
-                                   ::option::OptNoDefaultWithDrop* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    rs_std::StrRef, ::option::OptNoDefaultWithDrop* crubit_nonnull __ret_ptr);
 }
 inline ::option::OptNoDefaultWithDrop OptNoDefaultWithDrop::new_(
     rs_std::StrRef s) {
@@ -2198,7 +2226,8 @@ static_assert(
     alignof(OptZst) == 1,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::option::OptZst* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::option::OptZst* crubit_nonnull __ret_ptr);
 }
 inline ::option::OptZst::OptZst() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -2238,12 +2267,15 @@ inline void ZStream::__crubit_field_offset_assertions() {
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_pass_uoption_uptr(
-    rs_std::Option<::std::int32_t const*>*,
-    rs_std::Option<::std::int32_t const*>* __ret_ptr);
-}
-inline rs_std::Option<::std::int32_t const*> pass_option_ptr(
-    rs_std::Option<::std::int32_t const*> x) {
-  crubit::Slot<rs_std::Option<::std::int32_t const*>>
+    rs_std::Option<::std::int32_t const * crubit_nullability_unknown>*,
+    rs_std::Option<::std::int32_t const * crubit_nullability_unknown>*
+        crubit_nonnull __ret_ptr);
+}
+inline rs_std::Option<::std::int32_t const * crubit_nullability_unknown>
+pass_option_ptr(
+    rs_std::Option<::std::int32_t const * crubit_nullability_unknown> x) {
+  crubit::Slot<
+      rs_std::Option<::std::int32_t const * crubit_nullability_unknown>>
       __return_value_ret_val_holder;
   auto* __return_value_storage = __return_value_ret_val_holder.Get();
   __crubit_internal::__crubit_thunk_pass_uoption_uptr(&x,
@@ -2254,7 +2286,7 @@ inline rs_std::Option<::std::int32_t const*> pass_option_ptr(
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_return_uoption_uresult(
     rs_std::Option<rs_std::Result<::std::int32_t, ::rs::alloc::string::String>>*
-        __ret_ptr);
+        crubit_nonnull __ret_ptr);
 }
 inline rs_std::Option<
     rs_std::Result<::std::int32_t, ::rs::alloc::string::String>>
@@ -2270,8 +2302,9 @@ return_option_result() {
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_return_uoption_uresult_uunmovable(
-    rs_std::Option<rs_std::Result<::option::HasNoDefault,
-                                  ::rs::alloc::string::String>>* __ret_ptr);
+    rs_std::Option<
+        rs_std::Result<::option::HasNoDefault, ::rs::alloc::string::String>>*
+        crubit_nonnull __ret_ptr);
 }
 inline rs_std::Option<
     rs_std::Result<::option::HasNoDefault, ::rs::alloc::string::String>>
@@ -2291,7 +2324,8 @@ extern "C" void __crubit_thunk_stress_utesting_unested_utypes(
         rs_std::Option<
             rs_std::Result<::std::int32_t, ::rs::alloc::string::String>>,
         rs_std::Result<rs_std::Option<::std::int32_t>,
-                       rs_std::Option<::std::int32_t>>>>* __ret_ptr);
+                       rs_std::Option<::std::int32_t>>>>* crubit_nonnull
+        __ret_ptr);
 }
 inline rs_std::Option<rs_std::Result<
     rs_std::Option<rs_std::Result<::std::int32_t, ::rs::alloc::string::String>>,
@@ -2313,7 +2347,7 @@ stress_testing_nested_types() {
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_stringify_ulen(
     rs_std::Option<::option::HasDefault> const&,
-    rs_std::Option<::std::uint32_t>* __ret_ptr);
+    rs_std::Option<::std::uint32_t>* crubit_nonnull __ret_ptr);
 }
 inline rs_std::Option<::std::uint32_t> stringify_len(
     rs_std::Option<::option::HasDefault> const& x) {
@@ -2339,51 +2373,69 @@ inline void take_option_result_unmovable(
 
 }  // namespace option
 
-#ifndef _CRUBIT_BINDINGS_FOR_IMPL_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Option_x00000020_x0000003c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020int32_ut_x00000020const_x00000020_x0000002a_x00000020_x0000003e
-#define _CRUBIT_BINDINGS_FOR_IMPL_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Option_x00000020_x0000003c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020int32_ut_x00000020const_x00000020_x0000002a_x00000020_x0000003e
-static_assert(::std::is_trivially_copy_constructible_v<
-              rs_std::Option<::std::int32_t const*>>);
-static_assert(::std::is_trivially_copy_assignable_v<
-              rs_std::Option<::std::int32_t const*>>);
-static_assert(::std::is_trivially_move_constructible_v<
-              rs_std::Option<::std::int32_t const*>>);
-static_assert(::std::is_trivially_move_assignable_v<
-              rs_std::Option<::std::int32_t const*>>);
-inline constexpr rs_std::Option<::std::int32_t const*>::Option() { set_tag(0); }
-inline constexpr rs_std::Option<::std::int32_t const*>::Option(
-    ::std::nullopt_t) noexcept {
+#ifndef _CRUBIT_BINDINGS_FOR_IMPL_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Option_x00000020_x0000003c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020int32_ut_x00000020const_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000020_x0000003e
+#define _CRUBIT_BINDINGS_FOR_IMPL_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Option_x00000020_x0000003c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020int32_ut_x00000020const_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000020_x0000003e
+static_assert(
+    ::std::is_trivially_copy_constructible_v<
+        rs_std::Option<::std::int32_t const * crubit_nullability_unknown>>);
+static_assert(
+    ::std::is_trivially_copy_assignable_v<
+        rs_std::Option<::std::int32_t const * crubit_nullability_unknown>>);
+static_assert(
+    ::std::is_trivially_move_constructible_v<
+        rs_std::Option<::std::int32_t const * crubit_nullability_unknown>>);
+static_assert(
+    ::std::is_trivially_move_assignable_v<
+        rs_std::Option<::std::int32_t const * crubit_nullability_unknown>>);
+inline constexpr rs_std::Option<::std::int32_t const *
+                                crubit_nullability_unknown>::Option() {
   set_tag(0);
 }
-inline constexpr rs_std::Option<::std::int32_t const*>&
-rs_std::Option<::std::int32_t const*>::operator=(::std::nullopt_t) noexcept {
+inline constexpr rs_std::Option<
+    ::std::int32_t const *
+    crubit_nullability_unknown>::Option(::std::nullopt_t) noexcept {
+  set_tag(0);
+}
+inline constexpr rs_std::Option<::std::int32_t const *
+                                crubit_nullability_unknown>&
+rs_std::Option<::std::int32_t const * crubit_nullability_unknown>::operator=(
+    ::std::nullopt_t) noexcept {
   if (tag() != 0) {
-    ::std::destroy_at(reinterpret_cast<::std::int32_t const**>(storage_ + 8));
+    ::std::destroy_at(
+        reinterpret_cast<::std::int32_t const * crubit_nullability_unknown*>(
+            storage_ + 8));
   }
   set_tag(0);
   return *this;
 }
-inline rs_std::Option<::std::int32_t const*>::Option(
-    ::std::optional<::std::int32_t const*>&& value) noexcept {
+inline rs_std::Option<::std::int32_t const * crubit_nullability_unknown>::
+    Option(::std::optional<::std::int32_t const * crubit_nullability_unknown>&&
+               value) noexcept {
   if (value.has_value()) {
     set_tag(1);
-    ::std::int32_t const** some =
-        reinterpret_cast<::std::int32_t const**>(storage_ + 8);
+    ::std::int32_t const* crubit_nullability_unknown* some =
+        reinterpret_cast<::std::int32_t const * crubit_nullability_unknown*>(
+            storage_ + 8);
     *some = value.value();
     ::std::construct_at(&value, ::std::nullopt);
   } else {
     set_tag(0);
   }
 }
-inline rs_std::Option<::std::int32_t const*>&
-rs_std::Option<::std::int32_t const*>::operator=(
-    ::std::optional<::std::int32_t const*>&& value) noexcept {
+inline rs_std::Option<::std::int32_t const * crubit_nullability_unknown>&
+rs_std::Option<::std::int32_t const * crubit_nullability_unknown>::operator=(
+    ::std::optional<::std::int32_t const * crubit_nullability_unknown>&&
+        value) noexcept {
   if (tag() != 0) {
-    ::std::destroy_at(reinterpret_cast<::std::int32_t const**>(storage_ + 8));
+    ::std::destroy_at(
+        reinterpret_cast<::std::int32_t const * crubit_nullability_unknown*>(
+            storage_ + 8));
   }
   if (value.has_value()) {
     set_tag(1);
-    ::std::int32_t const** some =
-        reinterpret_cast<::std::int32_t const**>(storage_ + 8);
+    ::std::int32_t const* crubit_nullability_unknown* some =
+        reinterpret_cast<::std::int32_t const * crubit_nullability_unknown*>(
+            storage_ + 8);
     *some = value.value();
     ::std::construct_at(&value, ::std::nullopt);
   } else {
@@ -2392,67 +2444,87 @@ rs_std::Option<::std::int32_t const*>::operator=(
   return *this;
 }
 template <typename... Args>
-inline rs_std::Option<::std::int32_t const*>::Option(::std::in_place_t,
-                                                     Args&&... args) noexcept {
+inline rs_std::Option<::std::int32_t const * crubit_nullability_unknown>::
+    Option(::std::in_place_t, Args&&... args) noexcept {
   set_tag(1);
-  ::std::construct_at(reinterpret_cast<::std::int32_t const**>(storage_ + 8),
-                      ::std::forward<Args>(args)...);
+  ::std::construct_at(
+      reinterpret_cast<::std::int32_t const * crubit_nullability_unknown*>(
+          storage_ + 8),
+      ::std::forward<Args>(args)...);
 }
 static_assert(
-    ::std::is_trivially_destructible_v<rs_std::Option<::std::int32_t const*>>);
-inline rs_std::Option<::std::int32_t const*>::operator ::std::optional<
-    ::std::int32_t const*>() && noexcept {
+    ::std::is_trivially_destructible_v<
+        rs_std::Option<::std::int32_t const * crubit_nullability_unknown>>);
+inline rs_std::Option<::std::int32_t const * crubit_nullability_unknown>::
+operator ::std::optional<::std::int32_t const *
+                         crubit_nullability_unknown>() && noexcept {
   if (tag() == 0) {
     return ::std::nullopt;
   } else {
-    ::std::int32_t const*& value =
-        *reinterpret_cast<::std::int32_t const**>(storage_ + 8);
-    ::std::optional<::std::int32_t const*> return_value(::std::move(value));
+    ::std::int32_t const* crubit_nullability_unknown& value =
+        *reinterpret_cast<::std::int32_t const * crubit_nullability_unknown*>(
+            storage_ + 8);
+    ::std::optional<::std::int32_t const * crubit_nullability_unknown>
+        return_value(::std::move(value));
     ::std::destroy_at(&value);
     set_tag(0);
     return return_value;
   }
 }
-inline bool rs_std::Option<::std::int32_t const*>::has_value() const noexcept {
+inline bool
+rs_std::Option<::std::int32_t const * crubit_nullability_unknown>::has_value()
+    const noexcept {
   return tag() != 0;
 }
-inline void rs_std::Option<::std::int32_t const*>::check_has_value() const {
+inline void rs_std::Option<::std::int32_t const *
+                           crubit_nullability_unknown>::check_has_value()
+    const {
   CRUBIT_CHECK(has_value()) << "Bad value access on rs_std::Option";
 }
-inline ::std::int32_t const*&
-rs_std::Option<::std::int32_t const*>::operator*() & {
+inline ::std::int32_t const * crubit_nullability_unknown &
+    rs_std::Option<::std::int32_t const *
+                   crubit_nullability_unknown>::operator*() & {
   check_has_value();
-  return *reinterpret_cast<::std::int32_t const**>(storage_ + 8);
+  return *reinterpret_cast<::std::int32_t const * crubit_nullability_unknown*>(
+      storage_ + 8);
 }
-inline ::std::int32_t const* const&
-rs_std::Option<::std::int32_t const*>::operator*() const& {
+inline ::std::int32_t const* crubit_nullability_unknown const& rs_std::Option<
+    ::std::int32_t const * crubit_nullability_unknown>::operator*() const& {
   check_has_value();
-  return *reinterpret_cast<::std::int32_t const* const*>(storage_ + 8);
+  return *reinterpret_cast<::std::int32_t const *
+                           crubit_nullability_unknown const*>(storage_ + 8);
 }
-inline ::std::int32_t const*&&
-rs_std::Option<::std::int32_t const*>::operator*() && {
+inline ::std::int32_t const * crubit_nullability_unknown &&
+    rs_std::Option<::std::int32_t const *
+                   crubit_nullability_unknown>::operator*() && {
   check_has_value();
-  return ::std::move(*reinterpret_cast<::std::int32_t const**>(storage_ + 8));
+  return ::std::move(
+      *reinterpret_cast<::std::int32_t const * crubit_nullability_unknown*>(
+          storage_ + 8));
 }
-inline ::std::int32_t const**
-rs_std::Option<::std::int32_t const*>::operator->() {
+inline ::std::int32_t const * crubit_nullability_unknown *
+    rs_std::Option<::std::int32_t const *
+                   crubit_nullability_unknown>::operator->() {
   check_has_value();
-  return reinterpret_cast<::std::int32_t const**>(storage_ + 8);
+  return reinterpret_cast<::std::int32_t const * crubit_nullability_unknown*>(
+      storage_ + 8);
 }
-inline ::std::int32_t const* const*
-rs_std::Option<::std::int32_t const*>::operator->() const {
+inline ::std::int32_t const* crubit_nullability_unknown const* rs_std::Option<
+    ::std::int32_t const * crubit_nullability_unknown>::operator->() const {
   check_has_value();
-  return reinterpret_cast<::std::int32_t const* const*>(storage_ + 8);
+  return reinterpret_cast<::std::int32_t const *
+                          crubit_nullability_unknown const*>(storage_ + 8);
 }
-inline constexpr ::std::uint64_t rs_std::Option<::std::int32_t const*>::tag()
-    const& noexcept {
+inline constexpr ::std::uint64_t rs_std::Option<
+    ::std::int32_t const * crubit_nullability_unknown>::tag() const& noexcept {
   ::std::array<unsigned char, sizeof(::std::uint64_t)> __bytes = {};
   for (::std::size_t i = 0; i < sizeof(::std::uint64_t); ++i) {
     __bytes[i] = storage_[0 + i];
   }
   return ::std::bit_cast<::std::uint64_t>(__bytes);
 }
-inline constexpr void rs_std::Option<::std::int32_t const*>::set_tag(
+inline constexpr void
+rs_std::Option<::std::int32_t const * crubit_nullability_unknown>::set_tag(
     ::std::uint64_t tag) noexcept {
   auto __bytes =
       ::std::bit_cast<::std::array<unsigned char, sizeof(::std::uint64_t)>>(
@@ -2603,7 +2675,7 @@ inline constexpr void rs_std::Option<::std::int32_t>::set_tag(
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone(
     rs_std::Option<::option::CloneNoDefault> const&,
-    rs_std::Option<::option::CloneNoDefault>* __ret_ptr);
+    rs_std::Option<::option::CloneNoDefault>* crubit_nonnull __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(
@@ -3657,7 +3729,7 @@ extern "C" void __crubit_thunk_clone(
     rs_std::Option<
         rs_std::Result<::std::int32_t, ::rs::alloc::string::String>> const&,
     rs_std::Option<rs_std::Result<::std::int32_t, ::rs::alloc::string::String>>*
-        __ret_ptr);
+        crubit_nonnull __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(
@@ -4111,7 +4183,8 @@ extern "C" void __crubit_thunk_clone(
         rs_std::Option<
             rs_std::Result<::std::int32_t, ::rs::alloc::string::String>>,
         rs_std::Result<rs_std::Option<::std::int32_t>,
-                       rs_std::Option<::std::int32_t>>>>* __ret_ptr);
+                       rs_std::Option<::std::int32_t>>>>* crubit_nonnull
+        __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(
@@ -4766,41 +4839,58 @@ inline constexpr void rs_std::Option<::std::uint8_t>::set_tag(
 }
 #endif
 
-#ifndef _CRUBIT_BINDINGS_FOR_IMPL_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Option_x00000020_x0000003c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000003e
-#define _CRUBIT_BINDINGS_FOR_IMPL_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Option_x00000020_x0000003c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000003e
-static_assert(::std::is_trivially_copy_constructible_v<
-              rs_std::Option<crubit::type_identity_t<void(void*, void*)>*>>);
-static_assert(::std::is_trivially_copy_assignable_v<
-              rs_std::Option<crubit::type_identity_t<void(void*, void*)>*>>);
-static_assert(::std::is_trivially_move_constructible_v<
-              rs_std::Option<crubit::type_identity_t<void(void*, void*)>*>>);
-static_assert(::std::is_trivially_move_assignable_v<
-              rs_std::Option<crubit::type_identity_t<void(void*, void*)>*>>);
-inline constexpr rs_std::Option<
-    crubit::type_identity_t<void(void*, void*)>*>::Option() {
+#ifndef _CRUBIT_BINDINGS_FOR_IMPL_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Option_x00000020_x0000003c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000003e
+#define _CRUBIT_BINDINGS_FOR_IMPL_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Option_x00000020_x0000003c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000003e
+static_assert(
+    ::std::is_trivially_copy_constructible_v<rs_std::Option<
+        crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                     void* crubit_nullability_unknown)>*>>);
+static_assert(
+    ::std::is_trivially_copy_assignable_v<rs_std::Option<
+        crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                     void* crubit_nullability_unknown)>*>>);
+static_assert(
+    ::std::is_trivially_move_constructible_v<rs_std::Option<
+        crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                     void* crubit_nullability_unknown)>*>>);
+static_assert(
+    ::std::is_trivially_move_assignable_v<rs_std::Option<
+        crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                     void* crubit_nullability_unknown)>*>>);
+inline constexpr rs_std::Option<crubit::type_identity_t<
+    void(void* crubit_nullability_unknown,
+         void* crubit_nullability_unknown)>*>::Option() {
   set_tag(0);
 }
-inline constexpr rs_std::Option<crubit::type_identity_t<void(void*, void*)>*>::
+inline constexpr rs_std::Option<crubit::type_identity_t<void(
+    void* crubit_nullability_unknown, void* crubit_nullability_unknown)>*>::
     Option(::std::nullopt_t) noexcept {
   set_tag(0);
 }
-inline constexpr rs_std::Option<crubit::type_identity_t<void(void*, void*)>*>&
-rs_std::Option<crubit::type_identity_t<void(void*, void*)>*>::operator=(
-    ::std::nullopt_t) noexcept {
+inline constexpr rs_std::Option<crubit::type_identity_t<
+    void(void* crubit_nullability_unknown, void* crubit_nullability_unknown)>*>&
+rs_std::Option<crubit::type_identity_t<void(
+    void* crubit_nullability_unknown, void* crubit_nullability_unknown)>*>::
+operator=(::std::nullopt_t) noexcept {
   if (tag() != 0) {
-    ::std::destroy_at(
-        reinterpret_cast<crubit::type_identity_t<void(void*, void*)>**>(
-            storage_));
+    ::std::destroy_at(reinterpret_cast<crubit::type_identity_t<void(
+                          void* crubit_nullability_unknown,
+                          void* crubit_nullability_unknown)>**>(storage_));
   }
   set_tag(0);
   return *this;
 }
-inline rs_std::Option<crubit::type_identity_t<void(void*, void*)>*>::Option(
-    ::std::optional<crubit::type_identity_t<void(void*, void*)>*>&&
-        value) noexcept {
+inline rs_std::Option<crubit::type_identity_t<void(
+    void* crubit_nullability_unknown, void* crubit_nullability_unknown)>*>::
+    Option(::std::optional<crubit::type_identity_t<
+               void(void* crubit_nullability_unknown,
+                    void* crubit_nullability_unknown)>*>&& value) noexcept {
   if (value.has_value()) {
-    crubit::type_identity_t<void(void*, void*)>** some =
-        reinterpret_cast<crubit::type_identity_t<void(void*, void*)>**>(
+    crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                 void* crubit_nullability_unknown)>** some =
+        reinterpret_cast<
+            crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                         void* crubit_nullability_unknown)>**>(
             storage_);
     *some = value.value();
     ::std::construct_at(&value, ::std::nullopt);
@@ -4808,18 +4898,25 @@ inline rs_std::Option<crubit::type_identity_t<void(void*, void*)>*>::Option(
     set_tag(0);
   }
 }
-inline rs_std::Option<crubit::type_identity_t<void(void*, void*)>*>&
-rs_std::Option<crubit::type_identity_t<void(void*, void*)>*>::operator=(
-    ::std::optional<crubit::type_identity_t<void(void*, void*)>*>&&
+inline rs_std::Option<crubit::type_identity_t<
+    void(void* crubit_nullability_unknown, void* crubit_nullability_unknown)>*>&
+rs_std::Option<crubit::type_identity_t<void(
+    void* crubit_nullability_unknown, void* crubit_nullability_unknown)>*>::
+operator=(
+    ::std::optional<crubit::type_identity_t<void(
+        void* crubit_nullability_unknown, void* crubit_nullability_unknown)>*>&&
         value) noexcept {
   if (tag() != 0) {
-    ::std::destroy_at(
-        reinterpret_cast<crubit::type_identity_t<void(void*, void*)>**>(
-            storage_));
+    ::std::destroy_at(reinterpret_cast<crubit::type_identity_t<void(
+                          void* crubit_nullability_unknown,
+                          void* crubit_nullability_unknown)>**>(storage_));
   }
   if (value.has_value()) {
-    crubit::type_identity_t<void(void*, void*)>** some =
-        reinterpret_cast<crubit::type_identity_t<void(void*, void*)>**>(
+    crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                 void* crubit_nullability_unknown)>** some =
+        reinterpret_cast<
+            crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                         void* crubit_nullability_unknown)>**>(
             storage_);
     *some = value.value();
     ::std::construct_at(&value, ::std::nullopt);
@@ -4829,79 +4926,117 @@ rs_std::Option<crubit::type_identity_t<void(void*, void*)>*>::operator=(
   return *this;
 }
 template <typename... Args>
-inline rs_std::Option<crubit::type_identity_t<void(void*, void*)>*>::Option(
-    ::std::in_place_t, Args&&... args) noexcept {
+inline rs_std::Option<crubit::type_identity_t<void(
+    void* crubit_nullability_unknown, void* crubit_nullability_unknown)>*>::
+    Option(::std::in_place_t, Args&&... args) noexcept {
   ::std::construct_at(
-      reinterpret_cast<crubit::type_identity_t<void(void*, void*)>**>(storage_),
+      reinterpret_cast<
+          crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                       void* crubit_nullability_unknown)>**>(
+          storage_),
       ::std::forward<Args>(args)...);
 }
-static_assert(::std::is_trivially_destructible_v<
-              rs_std::Option<crubit::type_identity_t<void(void*, void*)>*>>);
-inline rs_std::Option<crubit::type_identity_t<void(void*, void*)>*>::operator ::
-    std::optional<crubit::type_identity_t<void(void*, void*)>*>() && noexcept {
+static_assert(
+    ::std::is_trivially_destructible_v<rs_std::Option<
+        crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                     void* crubit_nullability_unknown)>*>>);
+inline rs_std::Option<crubit::type_identity_t<void(
+    void* crubit_nullability_unknown, void* crubit_nullability_unknown)>*>::
+operator ::std::optional<crubit::type_identity_t<
+    void(void* crubit_nullability_unknown,
+         void* crubit_nullability_unknown)>*>() && noexcept {
   if (tag() == 0) {
     return ::std::nullopt;
   } else {
-    crubit::type_identity_t<void(void*, void*)>*& value =
-        *reinterpret_cast<crubit::type_identity_t<void(void*, void*)>**>(
+    crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                 void* crubit_nullability_unknown)>*& value =
+        *reinterpret_cast<
+            crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                         void* crubit_nullability_unknown)>**>(
             storage_);
-    ::std::optional<crubit::type_identity_t<void(void*, void*)>*> return_value(
-        ::std::move(value));
+    ::std::optional<crubit::type_identity_t<void(
+        void* crubit_nullability_unknown, void* crubit_nullability_unknown)>*>
+        return_value(::std::move(value));
     ::std::destroy_at(&value);
     set_tag(0);
     return return_value;
   }
 }
-inline bool rs_std::Option<
-    crubit::type_identity_t<void(void*, void*)>*>::has_value() const noexcept {
+inline bool rs_std::Option<crubit::type_identity_t<
+    void(void* crubit_nullability_unknown,
+         void* crubit_nullability_unknown)>*>::has_value() const noexcept {
   return tag() != 0;
 }
-inline void rs_std::Option<
-    crubit::type_identity_t<void(void*, void*)>*>::check_has_value() const {
+inline void rs_std::Option<crubit::type_identity_t<
+    void(void* crubit_nullability_unknown,
+         void* crubit_nullability_unknown)>*>::check_has_value() const {
   CRUBIT_CHECK(has_value()) << "Bad value access on rs_std::Option";
 }
-inline crubit::type_identity_t<void(void*, void*)>*&
-rs_std::Option<crubit::type_identity_t<void(void*, void*)>*>::operator*() & {
+inline crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                    void* crubit_nullability_unknown)>*&
+rs_std::Option<crubit::type_identity_t<
+    void(void* crubit_nullability_unknown,
+         void* crubit_nullability_unknown)>*>::operator*() & {
   check_has_value();
-  return *reinterpret_cast<crubit::type_identity_t<void(void*, void*)>**>(
+  return *reinterpret_cast<crubit::type_identity_t<void(
+      void* crubit_nullability_unknown, void* crubit_nullability_unknown)>**>(
       storage_);
 }
-inline crubit::type_identity_t<void(void*, void*)>* const& rs_std::Option<
-    crubit::type_identity_t<void(void*, void*)>*>::operator*() const& {
+inline crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                    void* crubit_nullability_unknown)>* const&
+rs_std::Option<crubit::type_identity_t<
+    void(void* crubit_nullability_unknown,
+         void* crubit_nullability_unknown)>*>::operator*() const& {
   check_has_value();
-  return *reinterpret_cast<crubit::type_identity_t<void(void*, void*)>* const*>(
+  return *reinterpret_cast<
+      crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                   void* crubit_nullability_unknown)>* const*>(
       storage_);
 }
-inline crubit::type_identity_t<void(void*, void*)>*&&
-rs_std::Option<crubit::type_identity_t<void(void*, void*)>*>::operator*() && {
+inline crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                    void* crubit_nullability_unknown)>*&&
+rs_std::Option<crubit::type_identity_t<
+    void(void* crubit_nullability_unknown,
+         void* crubit_nullability_unknown)>*>::operator*() && {
   check_has_value();
-  return ::std::move(
-      *reinterpret_cast<crubit::type_identity_t<void(void*, void*)>**>(
-          storage_));
-}
-inline crubit::type_identity_t<void(void*, void*)>**
-rs_std::Option<crubit::type_identity_t<void(void*, void*)>*>::operator->() {
+  return ::std::move(*reinterpret_cast<crubit::type_identity_t<void(
+                         void* crubit_nullability_unknown,
+                         void* crubit_nullability_unknown)>**>(storage_));
+}
+inline crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                    void* crubit_nullability_unknown)>**
+rs_std::Option<crubit::type_identity_t<
+    void(void* crubit_nullability_unknown,
+         void* crubit_nullability_unknown)>*>::operator->() {
   check_has_value();
-  return reinterpret_cast<crubit::type_identity_t<void(void*, void*)>**>(
+  return reinterpret_cast<crubit::type_identity_t<void(
+      void* crubit_nullability_unknown, void* crubit_nullability_unknown)>**>(
       storage_);
 }
-inline crubit::type_identity_t<void(void*, void*)>* const* rs_std::Option<
-    crubit::type_identity_t<void(void*, void*)>*>::operator->() const {
+inline crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                    void* crubit_nullability_unknown)>* const*
+rs_std::Option<crubit::type_identity_t<
+    void(void* crubit_nullability_unknown,
+         void* crubit_nullability_unknown)>*>::operator->() const {
   check_has_value();
-  return reinterpret_cast<crubit::type_identity_t<void(void*, void*)>* const*>(
+  return reinterpret_cast<
+      crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                   void* crubit_nullability_unknown)>* const*>(
       storage_);
 }
 inline constexpr ::std::uint64_t rs_std::Option<
-    crubit::type_identity_t<void(void*, void*)>*>::tag() const& noexcept {
+    crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                 void* crubit_nullability_unknown)>*>::tag()
+    const& noexcept {
   ::std::array<unsigned char, sizeof(::std::uint64_t)> __bytes = {};
   for (::std::size_t i = 0; i < sizeof(::std::uint64_t); ++i) {
     __bytes[i] = storage_[0 + i];
   }
   return ::std::bit_cast<::std::uint64_t>(__bytes);
 }
-inline constexpr void
-rs_std::Option<crubit::type_identity_t<void(void*, void*)>*>::set_tag(
-    ::std::uint64_t tag) noexcept {
+inline constexpr void rs_std::Option<crubit::type_identity_t<void(
+    void* crubit_nullability_unknown, void* crubit_nullability_unknown)>*>::
+    set_tag(::std::uint64_t tag) noexcept {
   auto __bytes =
       ::std::bit_cast<::std::array<unsigned char, sizeof(::std::uint64_t)>>(
           tag);
@@ -4916,7 +5051,8 @@ rs_std::Option<crubit::type_identity_t<void(void*, void*)>*>::set_tag(
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone(
     rs_std::Result<::std::int32_t, ::rs::alloc::string::String> const&,
-    rs_std::Result<::std::int32_t, ::rs::alloc::string::String>* __ret_ptr);
+    rs_std::Result<::std::int32_t, ::rs::alloc::string::String>* crubit_nonnull
+        __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(
@@ -5410,7 +5546,8 @@ extern "C" void __crubit_thunk_clone(
     rs_std::Result<rs_std::Option<rs_std::Result<::std::int32_t,
                                                  ::rs::alloc::string::String>>,
                    rs_std::Result<rs_std::Option<::std::int32_t>,
-                                  rs_std::Option<::std::int32_t>>>* __ret_ptr);
+                                  rs_std::Option<::std::int32_t>>>*
+        crubit_nonnull __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(
diff --git a/cc_bindings_from_rs/test/enums/result_cc_api.h b/cc_bindings_from_rs/test/enums/result_cc_api.h
index 4f721f1fc..cef7d272c 100644
--- a/cc_bindings_from_rs/test/enums/result_cc_api.h
+++ b/cc_bindings_from_rs/test/enums/result_cc_api.h
@@ -91,7 +91,8 @@ struct CRUBIT_INTERNAL_RUST_TYPE(":: result_golden :: CopyNoDefault") alignas(1)
 };
 
 using FreeFunc CRUBIT_INTERNAL_RUST_TYPE(":: result_golden :: FreeFunc") =
-    crubit::type_identity_t<void(void*, void*)>*;
+    crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                 void* crubit_nullability_unknown)>*;
 struct CRUBIT_INTERNAL_RUST_TYPE(":: result_golden :: HasDefault") alignas(8)
     [[clang::trivial_abi]] HasDefault final {
  public:
@@ -192,7 +193,8 @@ ResultWithSizeTypes final {
   static void __crubit_field_offset_assertions();
 };
 
-using Voidpf CRUBIT_INTERNAL_RUST_TYPE(":: result_golden :: Voidpf") = void*;
+using Voidpf CRUBIT_INTERNAL_RUST_TYPE(":: result_golden :: Voidpf") =
+    void* crubit_nullability_unknown;
 }  // namespace result
 
 #ifndef _CRUBIT_BINDINGS_FOR_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Result_x00000020_x0000003c_x00000020_x0000003a_x0000003a_x00000020result_x00000020_x0000003a_x0000003a_x00000020CloneNoDefault_x00000020_x0000002c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020uint8_ut_x00000020_x0000003e
@@ -1055,15 +1057,17 @@ ::std::uint8_t take_result_by_value(
 
 }  // namespace result
 
-#ifndef _CRUBIT_BINDINGS_FOR_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Result_x00000020_x0000003c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000002c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000003e
-#define _CRUBIT_BINDINGS_FOR_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Result_x00000020_x0000003c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000002c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000003e
+#ifndef _CRUBIT_BINDINGS_FOR_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Result_x00000020_x0000003c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000002c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000003e
+#define _CRUBIT_BINDINGS_FOR_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Result_x00000020_x0000003c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000002c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000003e
 template <>
 struct alignas(8) CRUBIT_INTERNAL_RUST_TYPE(
     "std :: result :: Result < unsafe extern \"C\" fn (* mut :: core :: ffi :: "
     "c_void , * mut :: core :: ffi :: c_void) , unsafe extern \"C\" fn (* mut "
-    ":: core :: ffi :: c_void , * mut :: core :: ffi :: c_void) >")
-    rs_std::Result<crubit::type_identity_t<void(void*, void*)>*,
-                   crubit::type_identity_t<void(void*, void*)>*> {
+    ":: core :: ffi :: c_void , * mut :: core :: ffi :: c_void) >") rs_std::
+    Result<crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                        void* crubit_nullability_unknown)>*,
+           crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                        void* crubit_nullability_unknown)>*> {
  public:
   // Rust types that are `Copy` get trivial, `default` C++ copy constructor and
   // assignment operator.
@@ -1087,15 +1091,33 @@ struct alignas(8) CRUBIT_INTERNAL_RUST_TYPE(
   Result(rs_std::unexpect_t, Args&&... args);
   explicit constexpr operator bool() const noexcept;
   constexpr bool has_value() const noexcept;
-  crubit::type_identity_t<void(void*, void*)>*& value() &;
-  crubit::type_identity_t<void(void*, void*)>*&& value() &&;
-  crubit::type_identity_t<void(void*, void*)>*& err() &;
-  crubit::type_identity_t<void(void*, void*)>*&& err() &&;
-  crubit::type_identity_t<void(void*, void*)>*& operator*() &;
-  crubit::type_identity_t<void(void*, void*)>* const& operator*() const&;
-  crubit::type_identity_t<void(void*, void*)>*&& operator*() &&;
-  crubit::type_identity_t<void(void*, void*)>** operator->();
-  crubit::type_identity_t<void(void*, void*)>* const* operator->() const;
+  crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                               void* crubit_nullability_unknown)>*&
+  value() &;
+  crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                               void* crubit_nullability_unknown)>*&&
+  value() &&;
+  crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                               void* crubit_nullability_unknown)>*&
+  err() &;
+  crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                               void* crubit_nullability_unknown)>*&&
+  err() &&;
+  crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                               void* crubit_nullability_unknown)>*&
+  operator*() &;
+  crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                               void* crubit_nullability_unknown)>* const&
+  operator*() const&;
+  crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                               void* crubit_nullability_unknown)>*&&
+  operator*() &&;
+  crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                               void* crubit_nullability_unknown)>**
+  operator->();
+  crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                               void* crubit_nullability_unknown)>* const*
+  operator->() const;
   ~Result() noexcept = default;
 
  private:
@@ -1129,8 +1151,11 @@ struct CRUBIT_INTERNAL_RUST_TYPE(":: result_golden :: ZStream") alignas(8)
     ::std::memcpy(this, &value, sizeof(value));
   }
   union {
-    rs_std::Result<crubit::type_identity_t<void(void*, void*)>*,
-                   crubit::type_identity_t<void(void*, void*)>*>
+    rs_std::Result<
+        crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                     void* crubit_nullability_unknown)>*,
+        crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                     void* crubit_nullability_unknown)>*>
         zfree;
   };
 
@@ -1150,7 +1175,8 @@ static_assert(
 static_assert(::std::is_trivially_move_assignable_v<::result::CloneNoDefault>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone(::result::CloneNoDefault const&,
-                                     ::result::CloneNoDefault* __ret_ptr);
+                                     ::result::CloneNoDefault* crubit_nonnull
+                                         __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(::result::CloneNoDefault&,
@@ -1181,8 +1207,8 @@ static_assert(
 static_assert(
     ::std::is_trivially_move_assignable_v<::result::CloneNoDefaultResult>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::uint8_t,
-                                   ::result::CloneNoDefaultResult* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::std::uint8_t, ::result::CloneNoDefaultResult* crubit_nonnull __ret_ptr);
 }
 inline ::result::CloneNoDefaultResult CloneNoDefaultResult::new_(
     ::std::uint8_t val) {
@@ -1223,8 +1249,8 @@ static_assert(
 static_assert(
     ::std::is_trivially_move_assignable_v<::result::CopyNoDefaultResult>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::uint8_t,
-                                   ::result::CopyNoDefaultResult* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::std::uint8_t, ::result::CopyNoDefaultResult* crubit_nonnull __ret_ptr);
 }
 inline ::result::CopyNoDefaultResult CopyNoDefaultResult::new_(
     ::std::uint8_t val) {
@@ -1247,8 +1273,8 @@ static_assert(::std::is_trivially_destructible_v<GetsResult>);
 static_assert(::std::is_trivially_move_constructible_v<::result::GetsResult>);
 static_assert(::std::is_trivially_move_assignable_v<::result::GetsResult>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::uint32_t,
-                                   ::result::GetsResult* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::std::uint32_t, ::result::GetsResult* crubit_nonnull __ret_ptr);
 }
 inline ::result::GetsResult GetsResult::new_(::std::uint32_t val) {
   crubit::Slot<::result::GetsResult> __return_value_ret_val_holder;
@@ -1266,7 +1292,8 @@ static_assert(
     alignof(HasDefault) == 8,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::result::HasDefault* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::result::HasDefault* crubit_nonnull __ret_ptr);
 }
 inline ::result::HasDefault::HasDefault() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -1286,8 +1313,8 @@ inline ::result::HasDefault& ::result::HasDefault::operator=(
   return *this;
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(rs_std::StrRef,
-                                   ::result::HasDefault* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    rs_std::StrRef, ::result::HasDefault* crubit_nonnull __ret_ptr);
 }
 inline ::result::HasDefault HasDefault::new_(rs_std::StrRef val) {
   crubit::Slot<::result::HasDefault> __return_value_ret_val_holder;
@@ -1320,8 +1347,8 @@ inline HasDefaultResult::~HasDefaultResult() {
   __crubit_internal::__crubit_thunk_drop(*this);
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(rs_std::StrRef,
-                                   ::result::HasDefaultResult* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    rs_std::StrRef, ::result::HasDefaultResult* crubit_nonnull __ret_ptr);
 }
 inline ::result::HasDefaultResult HasDefaultResult::new_(rs_std::StrRef val) {
   crubit::Slot<::result::HasDefaultResult> __return_value_ret_val_holder;
@@ -1369,8 +1396,8 @@ inline HasNoDefaultResult::~HasNoDefaultResult() {
   __crubit_internal::__crubit_thunk_drop(*this);
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(rs_std::StrRef,
-                                   ::result::HasNoDefaultResult* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    rs_std::StrRef, ::result::HasNoDefaultResult* crubit_nonnull __ret_ptr);
 }
 inline ::result::HasNoDefaultResult HasNoDefaultResult::new_(
     rs_std::StrRef val) {
@@ -1393,8 +1420,8 @@ static_assert(::std::is_trivially_destructible_v<NestedResult>);
 static_assert(::std::is_trivially_move_constructible_v<::result::NestedResult>);
 static_assert(::std::is_trivially_move_assignable_v<::result::NestedResult>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::uint32_t,
-                                   ::result::NestedResult* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::std::uint32_t, ::result::NestedResult* crubit_nonnull __ret_ptr);
 }
 inline ::result::NestedResult NestedResult::new_(::std::uint32_t val) {
   crubit::Slot<::result::NestedResult> __return_value_ret_val_holder;
@@ -1437,7 +1464,7 @@ inline void ZStream::__crubit_field_offset_assertions() {
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_return_uresult_uby_uvalue(
-    rs_std::Result<::std::uint8_t, ::std::uint8_t>* __ret_ptr);
+    rs_std::Result<::std::uint8_t, ::std::uint8_t>* crubit_nonnull __ret_ptr);
 }
 inline rs_std::Result<::std::uint8_t, ::std::uint8_t> return_result_by_value() {
   crubit::Slot<rs_std::Result<::std::uint8_t, ::std::uint8_t>>
@@ -1495,7 +1522,8 @@ inline rs_std::StrRef take_result_has_default(
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone(
     rs_std::Result<::result::CloneNoDefault, ::std::uint8_t> const&,
-    rs_std::Result<::result::CloneNoDefault, ::std::uint8_t>* __ret_ptr);
+    rs_std::Result<::result::CloneNoDefault, ::std::uint8_t>* crubit_nonnull
+        __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(
@@ -2614,7 +2642,8 @@ inline void rs_std::Result<::std::uint32_t, ::std::uint32_t>::check_has_err()
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone(
     rs_std::Result<::std::uint8_t, ::result::CloneNoDefault> const&,
-    rs_std::Result<::std::uint8_t, ::result::CloneNoDefault>* __ret_ptr);
+    rs_std::Result<::std::uint8_t, ::result::CloneNoDefault>* crubit_nonnull
+        __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(
@@ -3348,119 +3377,191 @@ inline void rs_std::Result<::std::uint8_t, ::std::uint8_t>::check_has_err()
 }
 #endif
 
-#ifndef _CRUBIT_BINDINGS_FOR_IMPL_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Result_x00000020_x0000003c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000002c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000003e
-#define _CRUBIT_BINDINGS_FOR_IMPL_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Result_x00000020_x0000003c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000002c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000003e
-static_assert(::std::is_trivially_copy_constructible_v<
-              rs_std::Result<crubit::type_identity_t<void(void*, void*)>*,
-                             crubit::type_identity_t<void(void*, void*)>*>>);
-static_assert(::std::is_trivially_copy_assignable_v<
-              rs_std::Result<crubit::type_identity_t<void(void*, void*)>*,
-                             crubit::type_identity_t<void(void*, void*)>*>>);
-static_assert(::std::is_trivially_move_constructible_v<
-              rs_std::Result<crubit::type_identity_t<void(void*, void*)>*,
-                             crubit::type_identity_t<void(void*, void*)>*>>);
-static_assert(::std::is_trivially_move_assignable_v<
-              rs_std::Result<crubit::type_identity_t<void(void*, void*)>*,
-                             crubit::type_identity_t<void(void*, void*)>*>>);
+#ifndef _CRUBIT_BINDINGS_FOR_IMPL_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Result_x00000020_x0000003c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000002c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000003e
+#define _CRUBIT_BINDINGS_FOR_IMPL_rs_ustd_x00000020_x0000003a_x0000003a_x00000020Result_x00000020_x0000003c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000002c_x00000020crubit_x00000020_x0000003a_x0000003a_x00000020type_uidentity_ut_x00000020_x0000003c_x00000020void_x00000020_x00000028void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000020_x0000002c_x00000020void_x00000020_x0000002a_x00000020crubit_unullability_uunknown_x00000029_x00000020_x0000003e_x00000020_x0000002a_x00000020_x0000003e
+static_assert(
+    ::std::is_trivially_copy_constructible_v<rs_std::Result<
+        crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                     void* crubit_nullability_unknown)>*,
+        crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                     void* crubit_nullability_unknown)>*>>);
+static_assert(
+    ::std::is_trivially_copy_assignable_v<rs_std::Result<
+        crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                     void* crubit_nullability_unknown)>*,
+        crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                     void* crubit_nullability_unknown)>*>>);
+static_assert(
+    ::std::is_trivially_move_constructible_v<rs_std::Result<
+        crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                     void* crubit_nullability_unknown)>*,
+        crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                     void* crubit_nullability_unknown)>*>>);
+static_assert(
+    ::std::is_trivially_move_assignable_v<rs_std::Result<
+        crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                     void* crubit_nullability_unknown)>*,
+        crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                     void* crubit_nullability_unknown)>*>>);
 
 template <typename... Args>
 inline rs_std::Result<
-    crubit::type_identity_t<void(void*, void*)>*,
-    crubit::type_identity_t<void(void*, void*)>*>::Result(std::in_place_t,
-                                                          Args&&... args) {
+    crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                 void* crubit_nullability_unknown)>*,
+    crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                 void* crubit_nullability_unknown)>*>::
+    Result(std::in_place_t, Args&&... args) {
   set_tag(0);
   std::construct_at(__storage + 8, std::forward<Args>(args)...);
 }
 template <typename... Args>
 inline rs_std::Result<
-    crubit::type_identity_t<void(void*, void*)>*,
-    crubit::type_identity_t<void(void*, void*)>*>::Result(rs_std::unexpect_t,
-                                                          Args&&... args) {
+    crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                 void* crubit_nullability_unknown)>*,
+    crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                 void* crubit_nullability_unknown)>*>::
+    Result(rs_std::unexpect_t, Args&&... args) {
   set_tag(1);
   std::construct_at(__storage + 8, std::forward<Args>(args)...);
 }
-inline constexpr rs_std::Result<crubit::type_identity_t<void(void*, void*)>*,
-                                crubit::type_identity_t<void(void*, void*)>*>::
+inline constexpr rs_std::Result<
+    crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                 void* crubit_nullability_unknown)>*,
+    crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                 void* crubit_nullability_unknown)>*>::
 operator bool() const noexcept {
   return has_value();
 }
 inline constexpr bool rs_std::Result<
-    crubit::type_identity_t<void(void*, void*)>*,
-    crubit::type_identity_t<void(void*, void*)>*>::has_value() const noexcept {
+    crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                 void* crubit_nullability_unknown)>*,
+    crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                 void* crubit_nullability_unknown)>*>::
+    has_value() const noexcept {
   return tag() == 0;
 }
-inline crubit::type_identity_t<void(void*, void*)>*&
-rs_std::Result<crubit::type_identity_t<void(void*, void*)>*,
-               crubit::type_identity_t<void(void*, void*)>*>::value() & {
+inline crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                    void* crubit_nullability_unknown)>*&
+rs_std::Result<crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                            void* crubit_nullability_unknown)>*,
+               crubit::type_identity_t<
+                   void(void* crubit_nullability_unknown,
+                        void* crubit_nullability_unknown)>*>::value() & {
   check_has_ok();
-  return *reinterpret_cast<crubit::type_identity_t<void(void*, void*)>**>(
+  return *reinterpret_cast<crubit::type_identity_t<void(
+      void* crubit_nullability_unknown, void* crubit_nullability_unknown)>**>(
       __storage + 8);
 }
-inline crubit::type_identity_t<void(void*, void*)>*&&
-rs_std::Result<crubit::type_identity_t<void(void*, void*)>*,
-               crubit::type_identity_t<void(void*, void*)>*>::value() && {
-  check_has_ok();
-  return ::std::move(
-      *reinterpret_cast<crubit::type_identity_t<void(void*, void*)>**>(
-          __storage + 8));
-}
-inline crubit::type_identity_t<void(void*, void*)>*&
-rs_std::Result<crubit::type_identity_t<void(void*, void*)>*,
-               crubit::type_identity_t<void(void*, void*)>*>::err() & {
+inline crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                    void* crubit_nullability_unknown)>*&&
+rs_std::Result<crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                            void* crubit_nullability_unknown)>*,
+               crubit::type_identity_t<
+                   void(void* crubit_nullability_unknown,
+                        void* crubit_nullability_unknown)>*>::value() && {
+  check_has_ok();
+  return ::std::move(*reinterpret_cast<crubit::type_identity_t<void(
+                         void* crubit_nullability_unknown,
+                         void* crubit_nullability_unknown)>**>(__storage + 8));
+}
+inline crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                    void* crubit_nullability_unknown)>*&
+rs_std::Result<
+    crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                 void* crubit_nullability_unknown)>*,
+    crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                 void* crubit_nullability_unknown)>*>::err() & {
   check_has_err();
-  return *reinterpret_cast<crubit::type_identity_t<void(void*, void*)>**>(
+  return *reinterpret_cast<crubit::type_identity_t<void(
+      void* crubit_nullability_unknown, void* crubit_nullability_unknown)>**>(
       __storage + 8);
 }
-inline crubit::type_identity_t<void(void*, void*)>*&&
-rs_std::Result<crubit::type_identity_t<void(void*, void*)>*,
-               crubit::type_identity_t<void(void*, void*)>*>::err() && {
+inline crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                    void* crubit_nullability_unknown)>*&&
+rs_std::Result<crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                            void* crubit_nullability_unknown)>*,
+               crubit::type_identity_t<
+                   void(void* crubit_nullability_unknown,
+                        void* crubit_nullability_unknown)>*>::err() && {
   check_has_err();
-  return ::std::move(
-      *reinterpret_cast<crubit::type_identity_t<void(void*, void*)>**>(
-          __storage + 8));
-}
-inline crubit::type_identity_t<void(void*, void*)>*&
-rs_std::Result<crubit::type_identity_t<void(void*, void*)>*,
-               crubit::type_identity_t<void(void*, void*)>*>::operator*() & {
-  check_has_ok();
-  return *reinterpret_cast<crubit::type_identity_t<void(void*, void*)>**>(
+  return ::std::move(*reinterpret_cast<crubit::type_identity_t<void(
+                         void* crubit_nullability_unknown,
+                         void* crubit_nullability_unknown)>**>(__storage + 8));
+}
+inline crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                    void* crubit_nullability_unknown)>*&
+rs_std::Result<crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                            void* crubit_nullability_unknown)>*,
+               crubit::type_identity_t<
+                   void(void* crubit_nullability_unknown,
+                        void* crubit_nullability_unknown)>*>::operator*() & {
+  check_has_ok();
+  return *reinterpret_cast<crubit::type_identity_t<void(
+      void* crubit_nullability_unknown, void* crubit_nullability_unknown)>**>(
       __storage + 8);
 }
-inline crubit::type_identity_t<void(void*, void*)>* const& rs_std::Result<
-    crubit::type_identity_t<void(void*, void*)>*,
-    crubit::type_identity_t<void(void*, void*)>*>::operator*() const& {
+inline crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                    void* crubit_nullability_unknown)>* const&
+rs_std::Result<crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                            void* crubit_nullability_unknown)>*,
+               crubit::type_identity_t<void(
+                   void* crubit_nullability_unknown,
+                   void* crubit_nullability_unknown)>*>::operator*() const& {
   check_has_ok();
-  return *reinterpret_cast<crubit::type_identity_t<void(void*, void*)>* const*>(
+  return *reinterpret_cast<
+      crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                   void* crubit_nullability_unknown)>* const*>(
       __storage + 8);
 }
-inline crubit::type_identity_t<void(void*, void*)>*&&
-rs_std::Result<crubit::type_identity_t<void(void*, void*)>*,
-               crubit::type_identity_t<void(void*, void*)>*>::operator*() && {
-  check_has_ok();
-  return ::std::move(
-      *reinterpret_cast<crubit::type_identity_t<void(void*, void*)>**>(
-          __storage + 8));
-}
-inline crubit::type_identity_t<void(void*, void*)>**
-rs_std::Result<crubit::type_identity_t<void(void*, void*)>*,
-               crubit::type_identity_t<void(void*, void*)>*>::operator->() {
-  check_has_ok();
-  return reinterpret_cast<crubit::type_identity_t<void(void*, void*)>**>(
+inline crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                    void* crubit_nullability_unknown)>*&&
+rs_std::Result<crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                            void* crubit_nullability_unknown)>*,
+               crubit::type_identity_t<
+                   void(void* crubit_nullability_unknown,
+                        void* crubit_nullability_unknown)>*>::operator*() && {
+  check_has_ok();
+  return ::std::move(*reinterpret_cast<crubit::type_identity_t<void(
+                         void* crubit_nullability_unknown,
+                         void* crubit_nullability_unknown)>**>(__storage + 8));
+}
+inline crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                    void* crubit_nullability_unknown)>**
+rs_std::Result<crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                            void* crubit_nullability_unknown)>*,
+               crubit::type_identity_t<
+                   void(void* crubit_nullability_unknown,
+                        void* crubit_nullability_unknown)>*>::operator->() {
+  check_has_ok();
+  return reinterpret_cast<crubit::type_identity_t<void(
+      void* crubit_nullability_unknown, void* crubit_nullability_unknown)>**>(
       __storage + 8);
 }
-inline crubit::type_identity_t<void(void*, void*)>* const* rs_std::Result<
-    crubit::type_identity_t<void(void*, void*)>*,
-    crubit::type_identity_t<void(void*, void*)>*>::operator->() const {
+inline crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                    void* crubit_nullability_unknown)>* const*
+rs_std::Result<crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                            void* crubit_nullability_unknown)>*,
+               crubit::type_identity_t<void(
+                   void* crubit_nullability_unknown,
+                   void* crubit_nullability_unknown)>*>::operator->() const {
   check_has_ok();
-  return reinterpret_cast<crubit::type_identity_t<void(void*, void*)>* const*>(
+  return reinterpret_cast<
+      crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                   void* crubit_nullability_unknown)>* const*>(
       __storage + 8);
 }
-static_assert(::std::is_trivially_destructible_v<
-              rs_std::Result<crubit::type_identity_t<void(void*, void*)>*,
-                             crubit::type_identity_t<void(void*, void*)>*>>);
+static_assert(
+    ::std::is_trivially_destructible_v<rs_std::Result<
+        crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                     void* crubit_nullability_unknown)>*,
+        crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                     void* crubit_nullability_unknown)>*>>);
 inline constexpr ::std::uint64_t rs_std::Result<
-    crubit::type_identity_t<void(void*, void*)>*,
-    crubit::type_identity_t<void(void*, void*)>*>::tag() const& noexcept {
+    crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                 void* crubit_nullability_unknown)>*,
+    crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                 void* crubit_nullability_unknown)>*>::tag()
+    const& noexcept {
   std::array<unsigned char, sizeof(::std::uint64_t)> __bytes = {};
   for (std::size_t i = 0; i < sizeof(::std::uint64_t); ++i) {
     __bytes[i] = __storage[0 + i];
@@ -3468,9 +3569,11 @@ inline constexpr ::std::uint64_t rs_std::Result<
   return std::bit_cast<::std::uint64_t>(__bytes);
 }
 inline constexpr void rs_std::Result<
-    crubit::type_identity_t<void(void*, void*)>*,
-    crubit::type_identity_t<void(void*, void*)>*>::set_tag(::std::uint64_t
-                                                               tag) noexcept {
+    crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                 void* crubit_nullability_unknown)>*,
+    crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                 void* crubit_nullability_unknown)>*>::
+    set_tag(::std::uint64_t tag) noexcept {
   auto __bytes =
       std::bit_cast<std::array<unsigned char, sizeof(::std::uint64_t)>>(tag);
   for (std::size_t i = 0; i < sizeof(::std::uint64_t); ++i) {
@@ -3478,14 +3581,20 @@ inline constexpr void rs_std::Result<
   }
 }
 
-inline void rs_std::Result<
-    crubit::type_identity_t<void(void*, void*)>*,
-    crubit::type_identity_t<void(void*, void*)>*>::check_has_ok() const {
+inline void
+rs_std::Result<crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                            void* crubit_nullability_unknown)>*,
+               crubit::type_identity_t<void(
+                   void* crubit_nullability_unknown,
+                   void* crubit_nullability_unknown)>*>::check_has_ok() const {
   CRUBIT_CHECK(has_value()) << "Bad value access on rs_std::Result";
 }
-inline void rs_std::Result<
-    crubit::type_identity_t<void(void*, void*)>*,
-    crubit::type_identity_t<void(void*, void*)>*>::check_has_err() const {
+inline void
+rs_std::Result<crubit::type_identity_t<void(void* crubit_nullability_unknown,
+                                            void* crubit_nullability_unknown)>*,
+               crubit::type_identity_t<void(
+                   void* crubit_nullability_unknown,
+                   void* crubit_nullability_unknown)>*>::check_has_err() const {
   CRUBIT_CHECK(!has_value()) << "Bad error access on rs_std::Result";
 }
 #endif
diff --git a/cc_bindings_from_rs/test/function_pointers/function_pointers_cc_api.h b/cc_bindings_from_rs/test/function_pointers/function_pointers_cc_api.h
index 8970d75a1..d2e5aa3c9 100644
--- a/cc_bindings_from_rs/test/function_pointers/function_pointers_cc_api.h
+++ b/cc_bindings_from_rs/test/function_pointers/function_pointers_cc_api.h
@@ -125,8 +125,9 @@ ::std::int32_t call_fn_ptr_with_five(
 
 // CRUBIT_ANNOTATE: must_bind=
 ::std::int32_t call_fn_ptr_with_repr_c_struct_ptr_containing_seven(
-    crubit::type_identity_t<
-        ::std::int32_t(::function_pointers::CStruct const*)>& fn_ptr);
+    crubit::type_identity_t<::std::int32_t(
+        ::function_pointers::CStruct const* crubit_nullability_unknown)>&
+        fn_ptr);
 
 // Error generating bindings for function
 // `function_pointers_golden::call_fn_ptr_with_repr_c_struct_ref` defined at
@@ -148,7 +149,8 @@ static_assert(
     alignof(CStruct) == 4,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::function_pointers::CStruct* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::function_pointers::CStruct* crubit_nonnull __ret_ptr);
 }
 inline ::function_pointers::CStruct::CStruct() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -182,7 +184,7 @@ static_assert(
     ::std::is_trivially_copy_assignable_v<::function_pointers::HasFnPtrField>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_with_uadd_uten(
-    ::function_pointers::HasFnPtrField* __ret_ptr);
+    ::function_pointers::HasFnPtrField* crubit_nonnull __ret_ptr);
 }
 inline ::function_pointers::HasFnPtrField HasFnPtrField::with_add_ten() {
   crubit::Slot<::function_pointers::HasFnPtrField>
@@ -216,12 +218,13 @@ inline ::std::int32_t call_fn_ptr_with_five(
 namespace __crubit_internal {
 extern "C" ::std::int32_t
 __crubit_thunk_call_ufn_uptr_uwith_urepr_uc_ustruct_uptr_ucontaining_useven(
-    crubit::type_identity_t<
-        ::std::int32_t(::function_pointers::CStruct const*)>&);
+    crubit::type_identity_t<::std::int32_t(
+        ::function_pointers::CStruct const* crubit_nullability_unknown)>&);
 }
 inline ::std::int32_t call_fn_ptr_with_repr_c_struct_ptr_containing_seven(
-    crubit::type_identity_t<
-        ::std::int32_t(::function_pointers::CStruct const*)>& fn_ptr) {
+    crubit::type_identity_t<::std::int32_t(
+        ::function_pointers::CStruct const* crubit_nullability_unknown)>&
+        fn_ptr) {
   return __crubit_internal::
       __crubit_thunk_call_ufn_uptr_uwith_urepr_uc_ustruct_uptr_ucontaining_useven(
           fn_ptr);
diff --git a/cc_bindings_from_rs/test/functions/functions_cc_api.h b/cc_bindings_from_rs/test/functions/functions_cc_api.h
index 76fcf005a..2515f28f6 100644
--- a/cc_bindings_from_rs/test/functions/functions_cc_api.h
+++ b/cc_bindings_from_rs/test/functions/functions_cc_api.h
@@ -90,8 +90,9 @@ double add_f64(double x, double y);
 //  `std::int32_t` is one such example - it requires `#include <cstdint>`.
 ::std::int32_t add_i32(::std::int32_t x, ::std::int32_t y);
 
-void add_i32_via_ptr(::std::int32_t const* x, ::std::int32_t const* y,
-                     ::std::int32_t* sum);
+void add_i32_via_ptr(::std::int32_t const* crubit_nullability_unknown x,
+                     ::std::int32_t const* crubit_nullability_unknown y,
+                     ::std::int32_t* crubit_nullability_unknown sum);
 
 ::std::int32_t apply_binary_i32_op(
     ::std::int32_t x, ::std::int32_t y,
@@ -420,12 +421,14 @@ inline ::std::int32_t add_i32(::std::int32_t x, ::std::int32_t y) {
 }
 
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_add_ui32_uvia_uptr(::std::int32_t const*,
-                                                  ::std::int32_t const*,
-                                                  ::std::int32_t*);
+extern "C" void __crubit_thunk_add_ui32_uvia_uptr(
+    ::std::int32_t const* crubit_nullability_unknown,
+    ::std::int32_t const* crubit_nullability_unknown,
+    ::std::int32_t* crubit_nullability_unknown);
 }
-inline void add_i32_via_ptr(::std::int32_t const* x, ::std::int32_t const* y,
-                            ::std::int32_t* sum) {
+inline void add_i32_via_ptr(::std::int32_t const* crubit_nullability_unknown x,
+                            ::std::int32_t const* crubit_nullability_unknown y,
+                            ::std::int32_t* crubit_nullability_unknown sum) {
   return __crubit_internal::__crubit_thunk_add_ui32_uvia_uptr(x, y, sum);
 }
 
@@ -599,7 +602,8 @@ static_assert(::std::is_trivially_move_assignable_v<
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_new(
     ::std::int32_t,
-    ::functions::generic_fn_tests::ctor_trait_tests::NonMovable* __ret_ptr);
+    ::functions::generic_fn_tests::ctor_trait_tests::NonMovable* crubit_nonnull
+        __ret_ptr);
 }
 inline ::functions::generic_fn_tests::ctor_trait_tests::NonMovable
 NonMovable::new_(::std::int32_t value) {
diff --git a/cc_bindings_from_rs/test/known_traits/default/default_cc_api.h b/cc_bindings_from_rs/test/known_traits/default/default_cc_api.h
index 0ea01c66b..4b57cbed7 100644
--- a/cc_bindings_from_rs/test/known_traits/default/default_cc_api.h
+++ b/cc_bindings_from_rs/test/known_traits/default/default_cc_api.h
@@ -256,7 +256,7 @@ static_assert(
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    ::rs_default::derived_impl::SomeStruct* __ret_ptr);
+    ::rs_default::derived_impl::SomeStruct* crubit_nonnull __ret_ptr);
 }
 inline ::rs_default::derived_impl::SomeStruct::SomeStruct() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -289,7 +289,7 @@ static_assert(
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    ::rs_default::explicit_impl::SomeStruct* __ret_ptr);
+    ::rs_default::explicit_impl::SomeStruct* crubit_nonnull __ret_ptr);
 }
 inline ::rs_default::explicit_impl::SomeStruct::SomeStruct() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -323,7 +323,7 @@ static_assert(
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
     ::rs_default::field_with_no_default::StructWithFieldWithNoDefault*
-        __ret_ptr);
+        crubit_nonnull __ret_ptr);
 }
 inline ::rs_default::field_with_no_default::StructWithFieldWithNoDefault::
     StructWithFieldWithNoDefault() {
diff --git a/cc_bindings_from_rs/test/known_traits/from/from_cc_api.h b/cc_bindings_from_rs/test/known_traits/from/from_cc_api.h
index a0c2a07ac..b5ffb7d7a 100644
--- a/cc_bindings_from_rs/test/known_traits/from/from_cc_api.h
+++ b/cc_bindings_from_rs/test/known_traits/from/from_cc_api.h
@@ -534,7 +534,8 @@ inline CloneAllocSource::~CloneAllocSource() {
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone(::from::CloneAllocSource const&,
-                                     ::from::CloneAllocSource* __ret_ptr);
+                                     ::from::CloneAllocSource* crubit_nonnull
+                                         __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(::from::CloneAllocSource&,
@@ -552,8 +553,8 @@ inline ::from::CloneAllocSource& ::from::CloneAllocSource::operator=(
   return *this;
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_create(rs_std::StrRef,
-                                      ::from::CloneAllocSource* __ret_ptr);
+extern "C" void __crubit_thunk_create(
+    rs_std::StrRef, ::from::CloneAllocSource* crubit_nonnull __ret_ptr);
 }
 inline ::from::CloneAllocSource CloneAllocSource::create(rs_std::StrRef s) {
   crubit::Slot<::from::CloneAllocSource> __return_value_ret_val_holder;
@@ -574,7 +575,8 @@ inline rs_std::StrRef CloneAllocSource::get_value() const& $(__anon1)
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_into_ufrom_ugolden_x0000003a_x0000003aCloneAllocType(
-    ::from::CloneAllocSource*, ::from::CloneAllocType* __ret_ptr);
+    ::from::CloneAllocSource*,
+    ::from::CloneAllocType* crubit_nonnull __ret_ptr);
 }
 inline CloneAllocSource::operator ::from::CloneAllocType() {
   auto&& self = *this;
@@ -603,7 +605,8 @@ inline CloneAllocType::~CloneAllocType() {
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone(::from::CloneAllocType const&,
-                                     ::from::CloneAllocType* __ret_ptr);
+                                     ::from::CloneAllocType* crubit_nonnull
+                                         __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(::from::CloneAllocType&,
@@ -631,7 +634,8 @@ inline rs_std::StrRef CloneAllocType::get_value() const& $(__anon1)
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_from_ufrom_ugolden_x0000003a_x0000003aCloneAllocSource(
-    ::from::CloneAllocSource*, ::from::CloneAllocType* __ret_ptr);
+    ::from::CloneAllocSource*,
+    ::from::CloneAllocType* crubit_nonnull __ret_ptr);
 }
 inline CloneAllocType::CloneAllocType(::from::CloneAllocSource value) {
   crubit::Slot value_slot((::std::move(value)));
@@ -658,7 +662,7 @@ static_assert(::std::is_trivially_copy_assignable_v<::from::CloneCopySource>);
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_into_ufrom_ugolden_x0000003a_x0000003aCloneCopyType(
-    ::from::CloneCopySource*, ::from::CloneCopyType* __ret_ptr);
+    ::from::CloneCopySource*, ::from::CloneCopyType* crubit_nonnull __ret_ptr);
 }
 inline CloneCopySource::operator ::from::CloneCopyType() {
   auto& self = const_cast<::std::remove_cvref_t<decltype(*this)>&>(*this);
@@ -679,7 +683,8 @@ static_assert(
     alignof(CloneCopyType) == 4,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::from::CloneCopyType* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::from::CloneCopyType* crubit_nonnull __ret_ptr);
 }
 inline ::from::CloneCopyType::CloneCopyType() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -692,7 +697,7 @@ static_assert(::std::is_trivially_copy_assignable_v<::from::CloneCopyType>);
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_from_ufrom_ugolden_x0000003a_x0000003aCloneCopySource(
-    ::from::CloneCopySource*, ::from::CloneCopyType* __ret_ptr);
+    ::from::CloneCopySource*, ::from::CloneCopyType* crubit_nonnull __ret_ptr);
 }
 inline CloneCopyType::CloneCopyType(::from::CloneCopySource value) {
   __crubit_internal::
@@ -715,7 +720,7 @@ static_assert(
     ::std::is_trivially_move_assignable_v<::from::CollidingConstructor>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_from_uusize(
-    ::std::uintptr_t, ::from::CollidingConstructor* __ret_ptr);
+    ::std::uintptr_t, ::from::CollidingConstructor* crubit_nonnull __ret_ptr);
 }
 inline CollidingConstructor::CollidingConstructor(::std::uintptr_t value) {
   __crubit_internal::__crubit_thunk_from_uusize(value, this);
@@ -734,7 +739,7 @@ static_assert(::std::is_trivially_move_constructible_v<::from::LoopA>);
 static_assert(::std::is_trivially_move_assignable_v<::from::LoopA>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_into_ufrom_ugolden_x0000003a_x0000003aLoopB(
-    ::from::LoopA*, ::from::LoopB* __ret_ptr);
+    ::from::LoopA*, ::from::LoopB* crubit_nonnull __ret_ptr);
 }
 inline LoopA::operator ::from::LoopB() {
   auto&& self = *this;
@@ -746,7 +751,7 @@ inline LoopA::operator ::from::LoopB() {
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_from_ufrom_ugolden_x0000003a_x0000003aLoopB(
-    ::from::LoopB*, ::from::LoopA* __ret_ptr);
+    ::from::LoopB*, ::from::LoopA* crubit_nonnull __ret_ptr);
 }
 inline LoopA::LoopA(::from::LoopB value) {
   __crubit_internal::__crubit_thunk_from_ufrom_ugolden_x0000003a_x0000003aLoopB(
@@ -766,7 +771,7 @@ static_assert(::std::is_trivially_move_constructible_v<::from::LoopB>);
 static_assert(::std::is_trivially_move_assignable_v<::from::LoopB>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_into_ufrom_ugolden_x0000003a_x0000003aLoopA(
-    ::from::LoopB*, ::from::LoopA* __ret_ptr);
+    ::from::LoopB*, ::from::LoopA* crubit_nonnull __ret_ptr);
 }
 inline LoopB::operator ::from::LoopA() {
   auto&& self = *this;
@@ -778,7 +783,7 @@ inline LoopB::operator ::from::LoopA() {
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_from_ufrom_ugolden_x0000003a_x0000003aLoopA(
-    ::from::LoopA*, ::from::LoopB* __ret_ptr);
+    ::from::LoopA*, ::from::LoopB* crubit_nonnull __ret_ptr);
 }
 inline LoopB::LoopB(::from::LoopA value) {
   __crubit_internal::__crubit_thunk_from_ufrom_ugolden_x0000003a_x0000003aLoopA(
@@ -801,7 +806,8 @@ static_assert(
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_into_ufrom_ugolden_x0000003a_x0000003aNoCloneCopyDropType(
-    ::from::NoCloneCopyDropSource*, ::from::NoCloneCopyDropType* __ret_ptr);
+    ::from::NoCloneCopyDropSource*,
+    ::from::NoCloneCopyDropType* crubit_nonnull __ret_ptr);
 }
 inline NoCloneCopyDropSource::operator ::from::NoCloneCopyDropType() {
   auto&& self = *this;
@@ -829,7 +835,8 @@ static_assert(
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_from_ufrom_ugolden_x0000003a_x0000003aNoCloneCopyDropSource(
-    ::from::NoCloneCopyDropSource*, ::from::NoCloneCopyDropType* __ret_ptr);
+    ::from::NoCloneCopyDropSource*,
+    ::from::NoCloneCopyDropType* crubit_nonnull __ret_ptr);
 }
 inline NoCloneCopyDropType::NoCloneCopyDropType(
     ::from::NoCloneCopyDropSource value) {
@@ -847,7 +854,8 @@ static_assert(
     alignof(NoCloneDefaultSource) == 4,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::from::NoCloneDefaultSource* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::from::NoCloneDefaultSource* crubit_nonnull __ret_ptr);
 }
 inline ::from::NoCloneDefaultSource::NoCloneDefaultSource() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -860,7 +868,8 @@ static_assert(
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_into_ufrom_ugolden_x0000003a_x0000003aNoCloneDefaultType(
-    ::from::NoCloneDefaultSource*, ::from::NoCloneDefaultType* __ret_ptr);
+    ::from::NoCloneDefaultSource*,
+    ::from::NoCloneDefaultType* crubit_nonnull __ret_ptr);
 }
 inline NoCloneDefaultSource::operator ::from::NoCloneDefaultType() {
   auto&& self = *this;
@@ -881,7 +890,8 @@ static_assert(
     alignof(NoCloneDefaultType) == 4,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::from::NoCloneDefaultType* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::from::NoCloneDefaultType* crubit_nonnull __ret_ptr);
 }
 inline ::from::NoCloneDefaultType::NoCloneDefaultType() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -894,7 +904,8 @@ static_assert(
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_from_ufrom_ugolden_x0000003a_x0000003aNoCloneDefaultSource(
-    ::from::NoCloneDefaultSource*, ::from::NoCloneDefaultType* __ret_ptr);
+    ::from::NoCloneDefaultSource*,
+    ::from::NoCloneDefaultType* crubit_nonnull __ret_ptr);
 }
 inline NoCloneDefaultType::NoCloneDefaultType(
     ::from::NoCloneDefaultSource value) {
@@ -915,7 +926,8 @@ static_assert(::std::is_trivially_destructible_v<NotFfiSafe>);
 static_assert(::std::is_trivially_move_constructible_v<::from::NotFfiSafe>);
 static_assert(::std::is_trivially_move_assignable_v<::from::NotFfiSafe>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_create(::from::NotFfiSafe* __ret_ptr);
+extern "C" void __crubit_thunk_create(
+    ::from::NotFfiSafe* crubit_nonnull __ret_ptr);
 }
 inline ::from::NotFfiSafe NotFfiSafe::create() {
   crubit::Slot<::from::NotFfiSafe> __return_value_ret_val_holder;
@@ -975,7 +987,7 @@ inline Opaque::operator ::std::int16_t() {
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_into_ufrom_ugolden_x0000003a_x0000003aOpaqueRef_x0000003c_x00000027static_x0000003e(
-    ::from::Opaque*, ::from::OpaqueRef* __ret_ptr);
+    ::from::Opaque*, ::from::OpaqueRef* crubit_nonnull __ret_ptr);
 }
 inline Opaque::operator ::from::OpaqueRef() {
   auto&& self = *this;
@@ -999,8 +1011,8 @@ static_assert(::std::is_trivially_destructible_v<OpaqueRef>);
 static_assert(::std::is_trivially_move_constructible_v<::from::OpaqueRef>);
 static_assert(::std::is_trivially_move_assignable_v<::from::OpaqueRef>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_create(rs_std::StrRef,
-                                      ::from::OpaqueRef* __ret_ptr);
+extern "C" void __crubit_thunk_create(
+    rs_std::StrRef, ::from::OpaqueRef* crubit_nonnull __ret_ptr);
 }
 inline ::from::OpaqueRef OpaqueRef::create(rs_std::StrRef s) {
   crubit::Slot<::from::OpaqueRef> __return_value_ret_val_holder;
@@ -1027,7 +1039,7 @@ inline OpaqueRef::operator rs_std::StrRef() {
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_from_ufrom_ugolden_x0000003a_x0000003aOpaque(
-    ::from::Opaque*, ::from::OpaqueRef* __ret_ptr);
+    ::from::Opaque*, ::from::OpaqueRef* crubit_nonnull __ret_ptr);
 }
 inline OpaqueRef::OpaqueRef(::from::Opaque value) {
   __crubit_internal::
diff --git a/cc_bindings_from_rs/test/known_traits/index/rs_index_cc_api.h b/cc_bindings_from_rs/test/known_traits/index/rs_index_cc_api.h
index 54e480c71..dd6fa7cc6 100644
--- a/cc_bindings_from_rs/test/known_traits/index/rs_index_cc_api.h
+++ b/cc_bindings_from_rs/test/known_traits/index/rs_index_cc_api.h
@@ -211,8 +211,8 @@ static_assert(
     ::std::is_trivially_copy_constructible_v<::rs_index::CustomIndex>);
 static_assert(::std::is_trivially_copy_assignable_v<::rs_index::CustomIndex>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::uintptr_t,
-                                   ::rs_index::CustomIndex* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::std::uintptr_t, ::rs_index::CustomIndex* crubit_nonnull __ret_ptr);
 }
 inline ::rs_index::CustomIndex CustomIndex::new_(::std::uintptr_t index) {
   crubit::Slot<::rs_index::CustomIndex> __return_value_ret_val_holder;
@@ -233,7 +233,8 @@ static_assert(::std::is_trivially_destructible_v<Id>);
 static_assert(::std::is_trivially_move_constructible_v<::rs_index::Id>);
 static_assert(::std::is_trivially_move_assignable_v<::rs_index::Id>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::int32_t, ::rs_index::Id* __ret_ptr);
+extern "C" void __crubit_thunk_new(::std::int32_t,
+                                   ::rs_index::Id* crubit_nonnull __ret_ptr);
 }
 inline ::rs_index::Id Id::new_(::std::int32_t id) {
   crubit::Slot<::rs_index::Id> __return_value_ret_val_holder;
@@ -255,7 +256,8 @@ static_assert(::std::is_trivially_move_constructible_v<::rs_index::IntPair>);
 static_assert(::std::is_trivially_move_assignable_v<::rs_index::IntPair>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_new(::std::int32_t, ::std::int32_t,
-                                   ::rs_index::IntPair* __ret_ptr);
+                                   ::rs_index::IntPair* crubit_nonnull
+                                       __ret_ptr);
 }
 inline ::rs_index::IntPair IntPair::new_(::std::int32_t x, ::std::int32_t y) {
   crubit::Slot<::rs_index::IntPair> __return_value_ret_val_holder;
@@ -332,7 +334,7 @@ extern "C" void __crubit_thunk_drop(::rs_index::Map&);
 inline Map::~Map() { __crubit_internal::__crubit_thunk_drop(*this); }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_new(::std::uintptr_t, ::std::uintptr_t,
-                                   ::rs_index::Map* __ret_ptr);
+                                   ::rs_index::Map* crubit_nonnull __ret_ptr);
 }
 inline ::rs_index::Map Map::new_(::std::uintptr_t row_size,
                                  ::std::uintptr_t col_size) {
diff --git a/cc_bindings_from_rs/test/known_traits/into/into_cc_api.h b/cc_bindings_from_rs/test/known_traits/into/into_cc_api.h
index 6dc954ff3..5ebbff57f 100644
--- a/cc_bindings_from_rs/test/known_traits/into/into_cc_api.h
+++ b/cc_bindings_from_rs/test/known_traits/into/into_cc_api.h
@@ -565,7 +565,8 @@ inline CloneAllocTarget::~CloneAllocTarget() {
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone(::into::CloneAllocTarget const&,
-                                     ::into::CloneAllocTarget* __ret_ptr);
+                                     ::into::CloneAllocTarget* crubit_nonnull
+                                         __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(::into::CloneAllocTarget&,
@@ -594,7 +595,8 @@ inline rs_std::StrRef CloneAllocTarget::get_value() const& $(__anon1)
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_into_into_ugolden_x0000003a_x0000003aCloneAllocType_as_into_ugolden_x0000003a_x0000003aCloneAllocTarget(
-    ::into::CloneAllocType*, ::into::CloneAllocTarget* __ret_ptr);
+    ::into::CloneAllocType*,
+    ::into::CloneAllocTarget* crubit_nonnull __ret_ptr);
 }
 inline CloneAllocTarget::CloneAllocTarget(::into::CloneAllocType value) {
   crubit::Slot value_slot((::std::move(value)));
@@ -619,7 +621,8 @@ inline CloneAllocType::~CloneAllocType() {
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone(::into::CloneAllocType const&,
-                                     ::into::CloneAllocType* __ret_ptr);
+                                     ::into::CloneAllocType* crubit_nonnull
+                                         __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(::into::CloneAllocType&,
@@ -636,8 +639,8 @@ inline ::into::CloneAllocType& ::into::CloneAllocType::operator=(
   return *this;
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_create(rs_std::StrRef,
-                                      ::into::CloneAllocType* __ret_ptr);
+extern "C" void __crubit_thunk_create(
+    rs_std::StrRef, ::into::CloneAllocType* crubit_nonnull __ret_ptr);
 }
 inline ::into::CloneAllocType CloneAllocType::create(rs_std::StrRef s) {
   crubit::Slot<::into::CloneAllocType> __return_value_ret_val_holder;
@@ -658,7 +661,8 @@ inline rs_std::StrRef CloneAllocType::get_value() const& $(__anon1)
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_into_uinto_ugolden_x0000003a_x0000003aCloneAllocTarget(
-    ::into::CloneAllocType*, ::into::CloneAllocTarget* __ret_ptr);
+    ::into::CloneAllocType*,
+    ::into::CloneAllocTarget* crubit_nonnull __ret_ptr);
 }
 inline CloneAllocType::operator ::into::CloneAllocTarget() {
   auto&& self = *this;
@@ -689,7 +693,7 @@ static_assert(::std::is_trivially_copy_assignable_v<::into::CloneCopyTarget>);
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_into_into_ugolden_x0000003a_x0000003aCloneCopyType_as_into_ugolden_x0000003a_x0000003aCloneCopyTarget(
-    ::into::CloneCopyType*, ::into::CloneCopyTarget* __ret_ptr);
+    ::into::CloneCopyType*, ::into::CloneCopyTarget* crubit_nonnull __ret_ptr);
 }
 inline CloneCopyTarget::CloneCopyTarget(::into::CloneCopyType value) {
   __crubit_internal::
@@ -706,7 +710,8 @@ static_assert(
     alignof(CloneCopyType) == 4,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::into::CloneCopyType* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::into::CloneCopyType* crubit_nonnull __ret_ptr);
 }
 inline ::into::CloneCopyType::CloneCopyType() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -719,7 +724,7 @@ static_assert(::std::is_trivially_copy_assignable_v<::into::CloneCopyType>);
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_into_uinto_ugolden_x0000003a_x0000003aCloneCopyTarget(
-    ::into::CloneCopyType*, ::into::CloneCopyTarget* __ret_ptr);
+    ::into::CloneCopyType*, ::into::CloneCopyTarget* crubit_nonnull __ret_ptr);
 }
 inline CloneCopyType::operator ::into::CloneCopyTarget() {
   auto& self = const_cast<::std::remove_cvref_t<decltype(*this)>&>(*this);
@@ -797,7 +802,7 @@ inline Convert::operator ::std::int16_t() {
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_into_into_ugolden_x0000003a_x0000003aConvertRef_x0000003c_x00000027_u_x0000003e_as_into_ugolden_x0000003a_x0000003aConvert(
-    ::into::ConvertRef*, ::into::Convert* __ret_ptr);
+    ::into::ConvertRef*, ::into::Convert* crubit_nonnull __ret_ptr);
 }
 inline Convert::Convert(::into::ConvertRef value) {
   __crubit_internal::
@@ -843,8 +848,8 @@ static_assert(::std::is_trivially_destructible_v<ConvertRef>);
 static_assert(::std::is_trivially_move_constructible_v<::into::ConvertRef>);
 static_assert(::std::is_trivially_move_assignable_v<::into::ConvertRef>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_create(rs_std::StrRef,
-                                      ::into::ConvertRef* __ret_ptr);
+extern "C" void __crubit_thunk_create(
+    rs_std::StrRef, ::into::ConvertRef* crubit_nonnull __ret_ptr);
 }
 inline ::into::ConvertRef ConvertRef::create(rs_std::StrRef s) {
   crubit::Slot<::into::ConvertRef> __return_value_ret_val_holder;
@@ -854,8 +859,8 @@ inline ::into::ConvertRef ConvertRef::create(rs_std::StrRef s) {
 }
 
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_transmigrate(::into::ConvertRef*,
-                                            ::into::Convert* __ret_ptr);
+extern "C" void __crubit_thunk_transmigrate(
+    ::into::ConvertRef*, ::into::Convert* crubit_nonnull __ret_ptr);
 }
 inline ::into::Convert ConvertRef::transmigrate() && {
   auto&& self = *this;
@@ -875,7 +880,7 @@ inline ConvertRef::operator rs_std::StrRef() {
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_into_uinto_ugolden_x0000003a_x0000003aConvert(
-    ::into::ConvertRef*, ::into::Convert* __ret_ptr);
+    ::into::ConvertRef*, ::into::Convert* crubit_nonnull __ret_ptr);
 }
 inline ConvertRef::operator ::into::Convert() {
   auto&& self = *this;
@@ -900,7 +905,7 @@ static_assert(::std::is_trivially_move_constructible_v<::into::LoopA>);
 static_assert(::std::is_trivially_move_assignable_v<::into::LoopA>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_into_uinto_ugolden_x0000003a_x0000003aLoopB(
-    ::into::LoopA*, ::into::LoopB* __ret_ptr);
+    ::into::LoopA*, ::into::LoopB* crubit_nonnull __ret_ptr);
 }
 inline LoopA::operator ::into::LoopB() {
   auto&& self = *this;
@@ -913,7 +918,7 @@ inline LoopA::operator ::into::LoopB() {
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_into_into_ugolden_x0000003a_x0000003aLoopB_as_into_ugolden_x0000003a_x0000003aLoopA(
-    ::into::LoopB*, ::into::LoopA* __ret_ptr);
+    ::into::LoopB*, ::into::LoopA* crubit_nonnull __ret_ptr);
 }
 inline LoopA::LoopA(::into::LoopB value) {
   __crubit_internal::
@@ -934,7 +939,7 @@ static_assert(::std::is_trivially_move_constructible_v<::into::LoopB>);
 static_assert(::std::is_trivially_move_assignable_v<::into::LoopB>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_into_uinto_ugolden_x0000003a_x0000003aLoopA(
-    ::into::LoopB*, ::into::LoopA* __ret_ptr);
+    ::into::LoopB*, ::into::LoopA* crubit_nonnull __ret_ptr);
 }
 inline LoopB::operator ::into::LoopA() {
   auto&& self = *this;
@@ -947,7 +952,7 @@ inline LoopB::operator ::into::LoopA() {
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_into_into_ugolden_x0000003a_x0000003aLoopA_as_into_ugolden_x0000003a_x0000003aLoopB(
-    ::into::LoopA*, ::into::LoopB* __ret_ptr);
+    ::into::LoopA*, ::into::LoopB* crubit_nonnull __ret_ptr);
 }
 inline LoopB::LoopB(::into::LoopA value) {
   __crubit_internal::
@@ -971,7 +976,8 @@ static_assert(
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_into_into_ugolden_x0000003a_x0000003aNoCloneCopyDropType_as_into_ugolden_x0000003a_x0000003aNoCloneCopyDropTarget(
-    ::into::NoCloneCopyDropType*, ::into::NoCloneCopyDropTarget* __ret_ptr);
+    ::into::NoCloneCopyDropType*,
+    ::into::NoCloneCopyDropTarget* crubit_nonnull __ret_ptr);
 }
 inline NoCloneCopyDropTarget::NoCloneCopyDropTarget(
     ::into::NoCloneCopyDropType value) {
@@ -996,7 +1002,8 @@ static_assert(
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_into_uinto_ugolden_x0000003a_x0000003aNoCloneCopyDropTarget(
-    ::into::NoCloneCopyDropType*, ::into::NoCloneCopyDropTarget* __ret_ptr);
+    ::into::NoCloneCopyDropType*,
+    ::into::NoCloneCopyDropTarget* crubit_nonnull __ret_ptr);
 }
 inline NoCloneCopyDropType::operator ::into::NoCloneCopyDropTarget() {
   auto&& self = *this;
@@ -1017,7 +1024,8 @@ static_assert(
     alignof(NoCloneDefaultTarget) == 4,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::into::NoCloneDefaultTarget* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::into::NoCloneDefaultTarget* crubit_nonnull __ret_ptr);
 }
 inline ::into::NoCloneDefaultTarget::NoCloneDefaultTarget() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -1030,7 +1038,8 @@ static_assert(
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_into_into_ugolden_x0000003a_x0000003aNoCloneDefaultType_as_into_ugolden_x0000003a_x0000003aNoCloneDefaultTarget(
-    ::into::NoCloneDefaultType*, ::into::NoCloneDefaultTarget* __ret_ptr);
+    ::into::NoCloneDefaultType*,
+    ::into::NoCloneDefaultTarget* crubit_nonnull __ret_ptr);
 }
 inline NoCloneDefaultTarget::NoCloneDefaultTarget(
     ::into::NoCloneDefaultType value) {
@@ -1048,7 +1057,8 @@ static_assert(
     alignof(NoCloneDefaultType) == 4,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::into::NoCloneDefaultType* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::into::NoCloneDefaultType* crubit_nonnull __ret_ptr);
 }
 inline ::into::NoCloneDefaultType::NoCloneDefaultType() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -1061,7 +1071,8 @@ static_assert(
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_into_uinto_ugolden_x0000003a_x0000003aNoCloneDefaultTarget(
-    ::into::NoCloneDefaultType*, ::into::NoCloneDefaultTarget* __ret_ptr);
+    ::into::NoCloneDefaultType*,
+    ::into::NoCloneDefaultTarget* crubit_nonnull __ret_ptr);
 }
 inline NoCloneDefaultType::operator ::into::NoCloneDefaultTarget() {
   auto&& self = *this;
diff --git a/cc_bindings_from_rs/test/known_traits/partial_eq/partial_eq_cc_api.h b/cc_bindings_from_rs/test/known_traits/partial_eq/partial_eq_cc_api.h
index 8b8d02b82..83f39c2da 100644
--- a/cc_bindings_from_rs/test/known_traits/partial_eq/partial_eq_cc_api.h
+++ b/cc_bindings_from_rs/test/known_traits/partial_eq/partial_eq_cc_api.h
@@ -189,7 +189,8 @@ static_assert(
     ::std::is_trivially_move_assignable_v<::partial_eq::basic_test::MyStruct>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_new(
-    ::std::uintptr_t, ::partial_eq::basic_test::MyStruct* __ret_ptr);
+    ::std::uintptr_t,
+    ::partial_eq::basic_test::MyStruct* crubit_nonnull __ret_ptr);
 }
 inline ::partial_eq::basic_test::MyStruct MyStruct::new_(::std::uintptr_t val) {
   crubit::Slot<::partial_eq::basic_test::MyStruct>
@@ -232,7 +233,8 @@ static_assert(::std::is_trivially_move_assignable_v<
               ::partial_eq::tuple_collision::MyStruct>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_new(
-    ::std::uintptr_t, ::partial_eq::tuple_collision::MyStruct* __ret_ptr);
+    ::std::uintptr_t,
+    ::partial_eq::tuple_collision::MyStruct* crubit_nonnull __ret_ptr);
 }
 inline ::partial_eq::tuple_collision::MyStruct MyStruct::new_(
     ::std::uintptr_t val) {
@@ -276,7 +278,8 @@ static_assert(
     ::std::is_trivially_move_assignable_v<::partial_eq::usize_rhs::MyStruct>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_new(
-    ::std::uintptr_t, ::partial_eq::usize_rhs::MyStruct* __ret_ptr);
+    ::std::uintptr_t,
+    ::partial_eq::usize_rhs::MyStruct* crubit_nonnull __ret_ptr);
 }
 inline ::partial_eq::usize_rhs::MyStruct MyStruct::new_(::std::uintptr_t val) {
   crubit::Slot<::partial_eq::usize_rhs::MyStruct> __return_value_ret_val_holder;
@@ -305,7 +308,7 @@ inline void MyStruct::__crubit_field_offset_assertions() {
 #define _CRUBIT_BINDINGS_FOR_IMPL__x0000003a_x0000003a_x00000020rs_ustd_x00000020_x0000003a_x0000003a_x00000020Tuple_x00000020_x0000003c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020uintptr_ut_x00000020_x0000002c_x00000020bool_x00000020_x0000003e
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    rs_std::Tuple<::std::uintptr_t, bool>* __ret_ptr);
+    rs_std::Tuple<::std::uintptr_t, bool>* crubit_nonnull __ret_ptr);
 }
 inline ::rs_std::Tuple<::std::uintptr_t, bool>::Tuple() {
   __crubit_internal::__crubit_thunk_default(this);
diff --git a/cc_bindings_from_rs/test/lifetimes/lifetimes_cc_api.h b/cc_bindings_from_rs/test/lifetimes/lifetimes_cc_api.h
index 7b7f6a913..5190372a5 100644
--- a/cc_bindings_from_rs/test/lifetimes/lifetimes_cc_api.h
+++ b/cc_bindings_from_rs/test/lifetimes/lifetimes_cc_api.h
@@ -162,7 +162,7 @@ static_assert(
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_from_uref(
     ::std::int32_t const* $a crubit_nonnull,
-    ::lifetimes::StructWithLifetime* __ret_ptr);
+    ::lifetimes::StructWithLifetime* crubit_nonnull __ret_ptr);
 }
 inline ::lifetimes::StructWithLifetime StructWithLifetime::from_ref(
     ::std::int32_t const* $a crubit_nonnull field_with_lifetime) {
@@ -203,7 +203,7 @@ inline ::std::int32_t const& $(__anon1) StructWithLifetime::borrow_from_self()
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_make_ustatic_u42(
-    ::lifetimes::StructWithLifetime* __ret_ptr);
+    ::lifetimes::StructWithLifetime* crubit_nonnull __ret_ptr);
 }
 inline ::lifetimes::StructWithLifetime StructWithLifetime::make_static_42() {
   crubit::Slot<::lifetimes::StructWithLifetime> __return_value_ret_val_holder;
@@ -215,7 +215,7 @@ inline ::lifetimes::StructWithLifetime StructWithLifetime::make_static_42() {
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_from_ustatic_uref(
     ::std::int32_t const* $static crubit_nonnull,
-    ::lifetimes::StructWithLifetime* __ret_ptr);
+    ::lifetimes::StructWithLifetime* crubit_nonnull __ret_ptr);
 }
 inline ::lifetimes::StructWithLifetime StructWithLifetime::from_static_ref(
     ::std::int32_t const* $static crubit_nonnull field_with_lifetime) {
@@ -229,7 +229,7 @@ inline ::lifetimes::StructWithLifetime StructWithLifetime::from_static_ref(
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_from_ustatic_uref_uwhere_ubound(
     ::std::int32_t const* $a crubit_nonnull,
-    ::lifetimes::StructWithLifetime* __ret_ptr);
+    ::lifetimes::StructWithLifetime* crubit_nonnull __ret_ptr);
 }
 inline ::lifetimes::StructWithLifetime
 StructWithLifetime::from_static_ref_where_bound(
@@ -272,7 +272,7 @@ inline StructWithLifetime::operator ::std::int32_t() {
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_from_u_x00000026_x00000027a_x00000020i32(
     ::std::int32_t const* $a crubit_nonnull,
-    ::lifetimes::StructWithLifetime* __ret_ptr);
+    ::lifetimes::StructWithLifetime* crubit_nonnull __ret_ptr);
 }
 inline StructWithLifetime::StructWithLifetime(
     ::std::int32_t const* $a crubit_nonnull value) {
@@ -297,7 +297,7 @@ inline StructWithLifetimeAndDropGlue::~StructWithLifetimeAndDropGlue() {
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_make_ustatic_u42(
-    ::lifetimes::StructWithLifetimeAndDropGlue* __ret_ptr);
+    ::lifetimes::StructWithLifetimeAndDropGlue* crubit_nonnull __ret_ptr);
 }
 inline ::lifetimes::StructWithLifetimeAndDropGlue
 StructWithLifetimeAndDropGlue::make_static_42() {
diff --git a/cc_bindings_from_rs/test/modules/modules_cc_api.h b/cc_bindings_from_rs/test/modules/modules_cc_api.h
index ec26d4937..f369bfe54 100644
--- a/cc_bindings_from_rs/test/modules/modules_cc_api.h
+++ b/cc_bindings_from_rs/test/modules/modules_cc_api.h
@@ -150,7 +150,8 @@ static_assert(::std::is_trivially_move_assignable_v<
               ::modules::impl_in_separate_private_module::Foo>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create(
-    ::std::int32_t, ::modules::impl_in_separate_private_module::Foo* __ret_ptr);
+    ::std::int32_t,
+    ::modules::impl_in_separate_private_module::Foo* crubit_nonnull __ret_ptr);
 }
 inline ::modules::impl_in_separate_private_module::Foo Foo::create(
     ::std::int32_t i) {
diff --git a/cc_bindings_from_rs/test/move_semantics/move_cc_api.h b/cc_bindings_from_rs/test/move_semantics/move_cc_api.h
index e5462ecec..947249b31 100644
--- a/cc_bindings_from_rs/test/move_semantics/move_cc_api.h
+++ b/cc_bindings_from_rs/test/move_semantics/move_cc_api.h
@@ -104,7 +104,8 @@ static_assert(
     alignof(Copyable) == 1,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::move::Copyable* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::move::Copyable* crubit_nonnull __ret_ptr);
 }
 inline ::move::Copyable::Copyable() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -115,8 +116,8 @@ static_assert(::std::is_trivially_move_assignable_v<::move::Copyable>);
 static_assert(::std::is_trivially_copy_constructible_v<::move::Copyable>);
 static_assert(::std::is_trivially_copy_assignable_v<::move::Copyable>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_from_ubyte(::std::uint8_t,
-                                          ::move::Copyable* __ret_ptr);
+extern "C" void __crubit_thunk_from_ubyte(
+    ::std::uint8_t, ::move::Copyable* crubit_nonnull __ret_ptr);
 }
 inline ::move::Copyable Copyable::from_byte(::std::uint8_t byte) {
   crubit::Slot<::move::Copyable> __return_value_ret_val_holder;
@@ -142,7 +143,7 @@ static_assert(
     alignof(Foo) == 8,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::move::Foo* __ret_ptr);
+extern "C" void __crubit_thunk_default(::move::Foo* crubit_nonnull __ret_ptr);
 }
 inline ::move::Foo::Foo() { __crubit_internal::__crubit_thunk_default(this); }
 namespace __crubit_internal {
@@ -155,8 +156,8 @@ inline ::move::Foo& ::move::Foo::operator=(Foo&& other) {
   return *this;
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_from_ubyte(::std::uint8_t,
-                                          ::move::Foo* __ret_ptr);
+extern "C" void __crubit_thunk_from_ubyte(
+    ::std::uint8_t, ::move::Foo* crubit_nonnull __ret_ptr);
 }
 inline ::move::Foo Foo::from_byte(::std::uint8_t byte) {
   crubit::Slot<::move::Foo> __return_value_ret_val_holder;
diff --git a/cc_bindings_from_rs/test/never/never_cc_api.h b/cc_bindings_from_rs/test/never/never_cc_api.h
index 1306ff403..feac28673 100644
--- a/cc_bindings_from_rs/test/never/never_cc_api.h
+++ b/cc_bindings_from_rs/test/never/never_cc_api.h
@@ -66,7 +66,8 @@ static_assert(
     alignof(NeverStruct) == 4,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::never::NeverStruct* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::never::NeverStruct* crubit_nonnull __ret_ptr);
 }
 inline ::never::NeverStruct::NeverStruct() {
   __crubit_internal::__crubit_thunk_default(this);
diff --git a/cc_bindings_from_rs/test/no_std/no_core_cc_api.h b/cc_bindings_from_rs/test/no_std/no_core_cc_api.h
index 15e916cf7..c35253ecb 100644
--- a/cc_bindings_from_rs/test/no_std/no_core_cc_api.h
+++ b/cc_bindings_from_rs/test/no_std/no_core_cc_api.h
@@ -72,7 +72,7 @@ extern "C" void __crubit_thunk_drop(::no_core::Test&);
 }
 inline Test::~Test() { __crubit_internal::__crubit_thunk_drop(*this); }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::no_core::Test* __ret_ptr);
+extern "C" void __crubit_thunk_new(::no_core::Test* crubit_nonnull __ret_ptr);
 }
 inline ::no_core::Test Test::new_() {
   crubit::Slot<::no_core::Test> __return_value_ret_val_holder;
diff --git a/cc_bindings_from_rs/test/no_std/no_std_cc_api.h b/cc_bindings_from_rs/test/no_std/no_std_cc_api.h
index 085d90276..79896c9a7 100644
--- a/cc_bindings_from_rs/test/no_std/no_std_cc_api.h
+++ b/cc_bindings_from_rs/test/no_std/no_std_cc_api.h
@@ -74,8 +74,8 @@ inline NoStdStruct::~NoStdStruct() {
   __crubit_internal::__crubit_thunk_drop(*this);
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::int32_t, float,
-                                   ::no_std::NoStdStruct* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::std::int32_t, float, ::no_std::NoStdStruct* crubit_nonnull __ret_ptr);
 }
 inline ::no_std::NoStdStruct NoStdStruct::new_(::std::int32_t x, float y) {
   crubit::Slot<::no_std::NoStdStruct> __return_value_ret_val_holder;
diff --git a/cc_bindings_from_rs/test/non_trivially_destructible/non_trivially_destructible_cc_api.h b/cc_bindings_from_rs/test/non_trivially_destructible/non_trivially_destructible_cc_api.h
index 76f3d5f87..f51b54032 100644
--- a/cc_bindings_from_rs/test/non_trivially_destructible/non_trivially_destructible_cc_api.h
+++ b/cc_bindings_from_rs/test/non_trivially_destructible/non_trivially_destructible_cc_api.h
@@ -72,7 +72,8 @@ static_assert(
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    ::non_trivially_destructible::NonTriviallyDestructable* __ret_ptr);
+    ::non_trivially_destructible::NonTriviallyDestructable* crubit_nonnull
+        __ret_ptr);
 }
 inline ::non_trivially_destructible::NonTriviallyDestructable::
     NonTriviallyDestructable() {
@@ -99,7 +100,8 @@ non_trivially_destructible::NonTriviallyDestructable::operator=(
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone(
     ::non_trivially_destructible::NonTriviallyDestructable const&,
-    ::non_trivially_destructible::NonTriviallyDestructable* __ret_ptr);
+    ::non_trivially_destructible::NonTriviallyDestructable* crubit_nonnull
+        __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(
@@ -123,7 +125,8 @@ inline void NonTriviallyDestructable::__crubit_field_offset_assertions() {
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_return_uby_uvalue(
-    ::non_trivially_destructible::NonTriviallyDestructable* __ret_ptr);
+    ::non_trivially_destructible::NonTriviallyDestructable* crubit_nonnull
+        __ret_ptr);
 }
 inline ::non_trivially_destructible::NonTriviallyDestructable
 return_by_value() {
diff --git a/cc_bindings_from_rs/test/primitive_types/primitive_types_cc_api.h b/cc_bindings_from_rs/test/primitive_types/primitive_types_cc_api.h
index e637ba922..36b061aa9 100644
--- a/cc_bindings_from_rs/test/primitive_types/primitive_types_cc_api.h
+++ b/cc_bindings_from_rs/test/primitive_types/primitive_types_cc_api.h
@@ -29,9 +29,11 @@
 
 namespace primitive_types::argument_types {
 
-void c_char_mut_ptr_arg(decltype(char(0))* __param_0);
+void c_char_mut_ptr_arg(
+    decltype(char(0))* crubit_nullability_unknown __param_0);
 
-void c_char_ptr_arg(decltype(char(0)) const* __param_0);
+void c_char_ptr_arg(decltype(char(0))
+                        const* crubit_nullability_unknown __param_0);
 
 }  // namespace primitive_types::argument_types
 
@@ -64,10 +66,10 @@ struct CRUBIT_INTERNAL_RUST_TYPE(
     crubit::type_identity_t<void(decltype(char(0)))>* c_char_func;
   };
   union {
-    void* c_void_mut_ptr;
+    void* crubit_nullability_unknown c_void_mut_ptr;
   };
   union {
-    const void* c_void_const_ptr;
+    const void* crubit_nullability_unknown c_void_const_ptr;
   };
   union {
     ::std::int64_t c_long;
@@ -158,11 +160,11 @@ namespace primitive_types::return_types {
 
 decltype(char(0)) c_char();
 
-decltype(char(0)) const* c_char_const_ptr();
+decltype(char(0)) const* crubit_nullability_unknown c_char_const_ptr();
 
 crubit::type_identity_t<void(decltype(char(0)))>& c_char_func();
 
-decltype(char(0))* c_char_mut_ptr();
+decltype(char(0))* crubit_nullability_unknown c_char_mut_ptr();
 
 double c_double();
 
@@ -190,9 +192,9 @@ ::std::uint16_t c_ushort();
 
 void c_void();
 
-const void* c_void_const_ptr();
+const void* crubit_nullability_unknown c_void_const_ptr();
 
-void* c_void_mut_ptr();
+void* crubit_nullability_unknown c_void_mut_ptr();
 
 float f32();
 
@@ -249,30 +251,36 @@ StructWithCVoidPointerMember final {
     ::std::memcpy(this, &value, sizeof(value));
   }
   union {
-    const void* ptr_const;
+    const void* crubit_nullability_unknown ptr_const;
   };
   union {
-    void* ptr_mut;
+    void* crubit_nullability_unknown ptr_mut;
   };
 
  private:
   static void __crubit_field_offset_assertions();
 };
 
-const void* identity_const_c_void_ptr(const void* ptr);
+const void* crubit_nullability_unknown
+identity_const_c_void_ptr(const void* crubit_nullability_unknown ptr);
 
-void* identity_mut_c_void_ptr(void* ptr);
+void* crubit_nullability_unknown
+identity_mut_c_void_ptr(void* crubit_nullability_unknown ptr);
 
 ::primitive_types::test_c_void_ptr::StructWithCVoidPointerMember
-new_struct_with_c_void_pointer_member(const void* ptr_const, void* ptr_mut);
+new_struct_with_c_void_pointer_member(const void* crubit_nullability_unknown
+                                          ptr_const,
+                                      void* crubit_nullability_unknown ptr_mut);
 
 }  // namespace primitive_types::test_c_void_ptr
 
 namespace primitive_types::test_maybe_uninit {
 
-::std::int32_t const* maybe_uninit_ptr(::std::int32_t const* maybe_uninit);
+::std::int32_t const* crubit_nullability_unknown
+maybe_uninit_ptr(::std::int32_t const* crubit_nullability_unknown maybe_uninit);
 
-::std::int32_t* maybe_uninit_ptr_mut(::std::int32_t* maybe_uninit);
+::std::int32_t* crubit_nullability_unknown
+maybe_uninit_ptr_mut(::std::int32_t* crubit_nullability_unknown maybe_uninit);
 
 ::std::int32_t const& $static
 maybe_uninit_ref(::std::int32_t const* $static maybe_uninit);
@@ -285,16 +293,20 @@ maybe_uninit_ref_mut(::std::int32_t* $static maybe_uninit);
 namespace primitive_types::argument_types {
 
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_c_uchar_umut_uptr_uarg(decltype(char(0))*);
+extern "C" void __crubit_thunk_c_uchar_umut_uptr_uarg(
+    decltype(char(0))* crubit_nullability_unknown);
 }
-inline void c_char_mut_ptr_arg(decltype(char(0))* __param_0) {
+inline void c_char_mut_ptr_arg(
+    decltype(char(0))* crubit_nullability_unknown __param_0) {
   return __crubit_internal::__crubit_thunk_c_uchar_umut_uptr_uarg(__param_0);
 }
 
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_c_uchar_uptr_uarg(decltype(char(0)) const*);
+extern "C" void __crubit_thunk_c_uchar_uptr_uarg(
+    decltype(char(0)) const* crubit_nullability_unknown);
 }
-inline void c_char_ptr_arg(decltype(char(0)) const* __param_0) {
+inline void c_char_ptr_arg(decltype(char(0))
+                               const* crubit_nullability_unknown __param_0) {
   return __crubit_internal::__crubit_thunk_c_uchar_uptr_uarg(__param_0);
 }
 
@@ -356,9 +368,10 @@ inline decltype(char(0)) c_char() {
 }
 
 namespace __crubit_internal {
-extern "C" decltype(char(0)) const* __crubit_thunk_c_uchar_uconst_uptr();
+extern "C" decltype(char(0)) const* crubit_nullability_unknown
+__crubit_thunk_c_uchar_uconst_uptr();
 }
-inline decltype(char(0)) const* c_char_const_ptr() {
+inline decltype(char(0)) const* crubit_nullability_unknown c_char_const_ptr() {
   return __crubit_internal::__crubit_thunk_c_uchar_uconst_uptr();
 }
 
@@ -371,9 +384,10 @@ inline crubit::type_identity_t<void(decltype(char(0)))>& c_char_func() {
 }
 
 namespace __crubit_internal {
-extern "C" decltype(char(0))* __crubit_thunk_c_uchar_umut_uptr();
+extern "C" decltype(char(0))* crubit_nullability_unknown
+__crubit_thunk_c_uchar_umut_uptr();
 }
-inline decltype(char(0))* c_char_mut_ptr() {
+inline decltype(char(0))* crubit_nullability_unknown c_char_mut_ptr() {
   return __crubit_internal::__crubit_thunk_c_uchar_umut_uptr();
 }
 
@@ -465,16 +479,17 @@ extern "C" void __crubit_thunk_c_uvoid();
 inline void c_void() { return __crubit_internal::__crubit_thunk_c_uvoid(); }
 
 namespace __crubit_internal {
-extern "C" const void* __crubit_thunk_c_uvoid_uconst_uptr();
+extern "C" const void* crubit_nullability_unknown
+__crubit_thunk_c_uvoid_uconst_uptr();
 }
-inline const void* c_void_const_ptr() {
+inline const void* crubit_nullability_unknown c_void_const_ptr() {
   return __crubit_internal::__crubit_thunk_c_uvoid_uconst_uptr();
 }
 
 namespace __crubit_internal {
-extern "C" void* __crubit_thunk_c_uvoid_umut_uptr();
+extern "C" void* crubit_nullability_unknown __crubit_thunk_c_uvoid_umut_uptr();
 }
-inline void* c_void_mut_ptr() {
+inline void* crubit_nullability_unknown c_void_mut_ptr() {
   return __crubit_internal::__crubit_thunk_c_uvoid_umut_uptr();
 }
 
@@ -572,28 +587,34 @@ inline void StructWithCVoidPointerMember::__crubit_field_offset_assertions() {
   static_assert(8 == offsetof(StructWithCVoidPointerMember, ptr_mut));
 }
 namespace __crubit_internal {
-extern "C" const void* __crubit_thunk_identity_uconst_uc_uvoid_uptr(
-    const void*);
+extern "C" const void* crubit_nullability_unknown
+__crubit_thunk_identity_uconst_uc_uvoid_uptr(
+    const void* crubit_nullability_unknown);
 }
-inline const void* identity_const_c_void_ptr(const void* ptr) {
+inline const void* crubit_nullability_unknown
+identity_const_c_void_ptr(const void* crubit_nullability_unknown ptr) {
   return __crubit_internal::__crubit_thunk_identity_uconst_uc_uvoid_uptr(ptr);
 }
 
 namespace __crubit_internal {
-extern "C" void* __crubit_thunk_identity_umut_uc_uvoid_uptr(void*);
+extern "C" void* crubit_nullability_unknown
+__crubit_thunk_identity_umut_uc_uvoid_uptr(void* crubit_nullability_unknown);
 }
-inline void* identity_mut_c_void_ptr(void* ptr) {
+inline void* crubit_nullability_unknown
+identity_mut_c_void_ptr(void* crubit_nullability_unknown ptr) {
   return __crubit_internal::__crubit_thunk_identity_umut_uc_uvoid_uptr(ptr);
 }
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_new_ustruct_uwith_uc_uvoid_upointer_umember(
-    const void*, void*,
+    const void* crubit_nullability_unknown, void* crubit_nullability_unknown,
     ::primitive_types::test_c_void_ptr::StructWithCVoidPointerMember*
-        __ret_ptr);
+        crubit_nonnull __ret_ptr);
 }
 inline ::primitive_types::test_c_void_ptr::StructWithCVoidPointerMember
-new_struct_with_c_void_pointer_member(const void* ptr_const, void* ptr_mut) {
+new_struct_with_c_void_pointer_member(
+    const void* crubit_nullability_unknown ptr_const,
+    void* crubit_nullability_unknown ptr_mut) {
   crubit::Slot<::primitive_types::test_c_void_ptr::StructWithCVoidPointerMember>
       __return_value_ret_val_holder;
   auto* __return_value_storage = __return_value_ret_val_holder.Get();
@@ -607,19 +628,22 @@ new_struct_with_c_void_pointer_member(const void* ptr_const, void* ptr_mut) {
 namespace primitive_types::test_maybe_uninit {
 
 namespace __crubit_internal {
-extern "C" ::std::int32_t const* __crubit_thunk_maybe_uuninit_uptr(
-    ::std::int32_t const*);
+extern "C" ::std::int32_t const* crubit_nullability_unknown
+__crubit_thunk_maybe_uuninit_uptr(
+    ::std::int32_t const* crubit_nullability_unknown);
 }
-inline ::std::int32_t const* maybe_uninit_ptr(
-    ::std::int32_t const* maybe_uninit) {
+inline ::std::int32_t const* crubit_nullability_unknown maybe_uninit_ptr(
+    ::std::int32_t const* crubit_nullability_unknown maybe_uninit) {
   return __crubit_internal::__crubit_thunk_maybe_uuninit_uptr(maybe_uninit);
 }
 
 namespace __crubit_internal {
-extern "C" ::std::int32_t* __crubit_thunk_maybe_uuninit_uptr_umut(
-    ::std::int32_t*);
+extern "C" ::std::int32_t* crubit_nullability_unknown
+__crubit_thunk_maybe_uuninit_uptr_umut(
+    ::std::int32_t* crubit_nullability_unknown);
 }
-inline ::std::int32_t* maybe_uninit_ptr_mut(::std::int32_t* maybe_uninit) {
+inline ::std::int32_t* crubit_nullability_unknown
+maybe_uninit_ptr_mut(::std::int32_t* crubit_nullability_unknown maybe_uninit) {
   return __crubit_internal::__crubit_thunk_maybe_uuninit_uptr_umut(
       maybe_uninit);
 }
diff --git a/cc_bindings_from_rs/test/str/str_cc_api.h b/cc_bindings_from_rs/test/str/str_cc_api.h
index 50fdbad7a..173c20fe7 100644
--- a/cc_bindings_from_rs/test/str/str_cc_api.h
+++ b/cc_bindings_from_rs/test/str/str_cc_api.h
@@ -56,7 +56,7 @@ struct CRUBIT_INTERNAL_RUST_TYPE(":: str_golden :: TypeWithStr") alignas(8)
 
   ::std::uintptr_t get_str_len() const;
 
-  ::std::uint8_t const* get_str_data() const;
+  ::std::uint8_t const* crubit_nullability_unknown get_str_data() const;
 
   union {
     rs_std::StrRef str_field;
@@ -68,7 +68,7 @@ struct CRUBIT_INTERNAL_RUST_TYPE(":: str_golden :: TypeWithStr") alignas(8)
 
 rs_std::StrRef foo_as_str();
 
-::std::uint8_t const* get_str_data(rs_std::StrRef s);
+::std::uint8_t const* crubit_nullability_unknown get_str_data(rs_std::StrRef s);
 
 ::std::uintptr_t get_str_len(rs_std::StrRef s);
 
@@ -82,7 +82,8 @@ static_assert(
     alignof(TypeWithStr) == 8,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::str::TypeWithStr* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::str::TypeWithStr* crubit_nonnull __ret_ptr);
 }
 inline ::str::TypeWithStr::TypeWithStr() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -93,8 +94,8 @@ static_assert(::std::is_trivially_move_assignable_v<::str::TypeWithStr>);
 static_assert(::std::is_trivially_copy_constructible_v<::str::TypeWithStr>);
 static_assert(::std::is_trivially_copy_assignable_v<::str::TypeWithStr>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_create(rs_std::StrRef,
-                                      ::str::TypeWithStr* __ret_ptr);
+extern "C" void __crubit_thunk_create(
+    rs_std::StrRef, ::str::TypeWithStr* crubit_nonnull __ret_ptr);
 }
 inline ::str::TypeWithStr TypeWithStr::create(rs_std::StrRef s) {
   crubit::Slot<::str::TypeWithStr> __return_value_ret_val_holder;
@@ -113,10 +114,11 @@ inline ::std::uintptr_t TypeWithStr::get_str_len() const {
 }
 
 namespace __crubit_internal {
-extern "C" ::std::uint8_t const* __crubit_thunk_get_ustr_udata(
-    ::str::TypeWithStr const&);
+extern "C" ::std::uint8_t const* crubit_nullability_unknown
+__crubit_thunk_get_ustr_udata(::str::TypeWithStr const&);
 }
-inline ::std::uint8_t const* TypeWithStr::get_str_data() const {
+inline ::std::uint8_t const* crubit_nullability_unknown
+TypeWithStr::get_str_data() const {
   auto&& self = *this;
   return __crubit_internal::__crubit_thunk_get_ustr_udata(self);
 }
@@ -131,9 +133,11 @@ inline rs_std::StrRef foo_as_str() {
 }
 
 namespace __crubit_internal {
-extern "C" ::std::uint8_t const* __crubit_thunk_get_ustr_udata(rs_std::StrRef);
+extern "C" ::std::uint8_t const* crubit_nullability_unknown
+    __crubit_thunk_get_ustr_udata(rs_std::StrRef);
 }
-inline ::std::uint8_t const* get_str_data(rs_std::StrRef s) {
+inline ::std::uint8_t const* crubit_nullability_unknown
+get_str_data(rs_std::StrRef s) {
   return __crubit_internal::__crubit_thunk_get_ustr_udata(s);
 }
 
diff --git a/cc_bindings_from_rs/test/structs/const_field/const_field_cc_api.h b/cc_bindings_from_rs/test/structs/const_field/const_field_cc_api.h
index 9a53ac7ce..468aa67f6 100644
--- a/cc_bindings_from_rs/test/structs/const_field/const_field_cc_api.h
+++ b/cc_bindings_from_rs/test/structs/const_field/const_field_cc_api.h
@@ -14,6 +14,7 @@
 #pragma clang diagnostic ignored "-Wunused-private-field"
 #pragma clang diagnostic ignored "-Wdeprecated-declarations"
 #pragma clang diagnostic ignored "-Wignored-attributes"
+#include "support/annotations_internal.h"
 #include "support/bridge.h"
 #include "support/internal/check.h"
 #include "support/internal/move_assign.h"
@@ -95,7 +96,7 @@ return_struct_with_const_field_by_value_in_result();
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_return_ustruct_uwith_uconst_ufield_uby_uvalue_uin_uoption(
-    unsigned char* __ret_ptr);
+    unsigned char* crubit_nonnull __ret_ptr);
 }
 inline ::std::optional<::struct_with_const_field>
 return_struct_with_const_field_by_value_in_option() {
@@ -114,7 +115,8 @@ return_struct_with_const_field_by_value_in_option() {
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_return_ustruct_uwith_uconst_ufield_uby_uvalue_uin_uresult(
-    rs_std::Result<::struct_with_const_field, ::std::uint8_t>* __ret_ptr);
+    rs_std::Result<::struct_with_const_field, ::std::uint8_t>* crubit_nonnull
+        __ret_ptr);
 }
 inline rs_std::Result<::struct_with_const_field, ::std::uint8_t>
 return_struct_with_const_field_by_value_in_result() {
diff --git a/cc_bindings_from_rs/test/structs/structs_cc_api.h b/cc_bindings_from_rs/test/structs/structs_cc_api.h
index e8dcc20de..284700f0e 100644
--- a/cc_bindings_from_rs/test/structs/structs_cc_api.h
+++ b/cc_bindings_from_rs/test/structs/structs_cc_api.h
@@ -373,10 +373,12 @@ struct CRUBIT_INTERNAL_RUST_TYPE(
     ::std::memcpy(this, &value, sizeof(value));
   }
   union {
-    float const** mut_const_ptr;
+    float const * crubit_nullability_unknown *
+        crubit_nullability_unknown mut_const_ptr;
   };
   union {
-    float* const* const_mut_ptr;
+    float* crubit_nullability_unknown const* crubit_nullability_unknown
+        const_mut_ptr;
   };
 
  private:
@@ -714,7 +716,8 @@ static_assert(::std::is_trivially_move_assignable_v<
               ::structs::abi_classification::StructFloat>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create(
-    float, ::structs::abi_classification::StructFloat* __ret_ptr);
+    float,
+    ::structs::abi_classification::StructFloat* crubit_nonnull __ret_ptr);
 }
 inline ::structs::abi_classification::StructFloat StructFloat::create(float f) {
   crubit::Slot<::structs::abi_classification::StructFloat>
@@ -728,7 +731,7 @@ namespace __crubit_internal {
 extern "C" void __crubit_thunk_multiply(
     ::structs::abi_classification::StructFloat*,
     ::structs::abi_classification::StructFloat*,
-    ::structs::abi_classification::StructFloat* __ret_ptr);
+    ::structs::abi_classification::StructFloat* crubit_nonnull __ret_ptr);
 }
 inline ::structs::abi_classification::StructFloat StructFloat::multiply(
     ::structs::abi_classification::StructFloat x,
@@ -765,7 +768,8 @@ static_assert(::std::is_trivially_move_assignable_v<
               ::structs::abi_classification::StructInteger>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create(
-    ::std::int32_t, ::structs::abi_classification::StructInteger* __ret_ptr);
+    ::std::int32_t,
+    ::structs::abi_classification::StructInteger* crubit_nonnull __ret_ptr);
 }
 inline ::structs::abi_classification::StructInteger StructInteger::create(
     ::std::int32_t i) {
@@ -780,7 +784,7 @@ namespace __crubit_internal {
 extern "C" void __crubit_thunk_multiply(
     ::structs::abi_classification::StructInteger*,
     ::structs::abi_classification::StructInteger*,
-    ::structs::abi_classification::StructInteger* __ret_ptr);
+    ::structs::abi_classification::StructInteger* crubit_nonnull __ret_ptr);
 }
 inline ::structs::abi_classification::StructInteger StructInteger::multiply(
     ::structs::abi_classification::StructInteger x,
@@ -816,7 +820,8 @@ static_assert(::std::is_trivially_move_assignable_v<
               ::structs::abi_classification::StructMemory>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create(
-    ::std::int32_t, ::structs::abi_classification::StructMemory* __ret_ptr);
+    ::std::int32_t,
+    ::structs::abi_classification::StructMemory* crubit_nonnull __ret_ptr);
 }
 inline ::structs::abi_classification::StructMemory StructMemory::create(
     ::std::int32_t i) {
@@ -831,7 +836,7 @@ namespace __crubit_internal {
 extern "C" void __crubit_thunk_multiply(
     ::structs::abi_classification::StructMemory*,
     ::structs::abi_classification::StructMemory*,
-    ::structs::abi_classification::StructMemory* __ret_ptr);
+    ::structs::abi_classification::StructMemory* crubit_nonnull __ret_ptr);
 }
 inline ::structs::abi_classification::StructMemory StructMemory::multiply(
     ::structs::abi_classification::StructMemory x,
@@ -876,7 +881,8 @@ inline void Point::__crubit_field_offset_assertions() {
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create(
-    ::std::int32_t, ::std::int32_t, ::structs::default_repr::Point* __ret_ptr);
+    ::std::int32_t, ::std::int32_t,
+    ::structs::default_repr::Point* crubit_nonnull __ret_ptr);
 }
 inline ::structs::default_repr::Point create(::std::int32_t x,
                                              ::std::int32_t y) {
@@ -917,7 +923,8 @@ inline void DisplayStruct::__crubit_field_offset_assertions() {
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create(
-    ::std::int32_t, ::structs::display::DisplayStruct* __ret_ptr);
+    ::std::int32_t,
+    ::structs::display::DisplayStruct* crubit_nonnull __ret_ptr);
 }
 inline ::structs::display::DisplayStruct create(::std::int32_t value) {
   crubit::Slot<::structs::display::DisplayStruct> __return_value_ret_val_holder;
@@ -938,7 +945,7 @@ static_assert(
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    ::structs::interior_mutability::SomeStruct* __ret_ptr);
+    ::structs::interior_mutability::SomeStruct* crubit_nonnull __ret_ptr);
 }
 inline ::structs::interior_mutability::SomeStruct::SomeStruct() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -989,7 +996,8 @@ static_assert(
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    ::structs::nested_ptr_type_mutability_qualifiers::SomeStruct* __ret_ptr);
+    ::structs::nested_ptr_type_mutability_qualifiers::SomeStruct* crubit_nonnull
+        __ret_ptr);
 }
 inline ::structs::nested_ptr_type_mutability_qualifiers::SomeStruct::
     SomeStruct() {
@@ -1025,7 +1033,7 @@ inline void Point::__crubit_field_offset_assertions() {
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create(
     ::std::int32_t, ::std::int32_t,
-    ::structs::non_cpp_movable::Point* __ret_ptr);
+    ::structs::non_cpp_movable::Point* crubit_nonnull __ret_ptr);
 }
 inline ::structs::non_cpp_movable::Point create(::std::int32_t x,
                                                 ::std::int32_t y) {
@@ -1063,7 +1071,8 @@ inline void Point::__crubit_field_offset_assertions() {
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create(::std::int32_t, ::std::int32_t,
-                                      ::structs::repr_c::Point* __ret_ptr);
+                                      ::structs::repr_c::Point* crubit_nonnull
+                                          __ret_ptr);
 }
 inline ::structs::repr_c::Point create(::std::int32_t x, ::std::int32_t y) {
   crubit::Slot<::structs::repr_c::Point> __return_value_ret_val_holder;
@@ -1104,7 +1113,7 @@ namespace __crubit_internal {
 extern "C" void __crubit_thunk_no_umangle_ucreate(
     float,
     ::structs::struct_by_float_passing_with_no_cc_definition::StructFloat*
-        __ret_ptr);
+        crubit_nonnull __ret_ptr);
 }
 inline ::structs::struct_by_float_passing_with_no_cc_definition::StructFloat
 no_mangle_create(float f) {
@@ -1131,7 +1140,7 @@ extern "C" void __crubit_thunk_no_umangle_umultiply(
     ::structs::struct_by_float_passing_with_no_cc_definition::StructFloat*,
     ::structs::struct_by_float_passing_with_no_cc_definition::StructFloat*,
     ::structs::struct_by_float_passing_with_no_cc_definition::StructFloat*
-        __ret_ptr);
+        crubit_nonnull __ret_ptr);
 }
 inline ::structs::struct_by_float_passing_with_no_cc_definition::StructFloat
 no_mangle_multiply(
@@ -1164,7 +1173,8 @@ static_assert(::std::is_trivially_move_assignable_v<
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone(
     ::structs::struct_by_float_passing_with_no_thunk::StructFloat const&,
-    ::structs::struct_by_float_passing_with_no_thunk::StructFloat* __ret_ptr);
+    ::structs::struct_by_float_passing_with_no_thunk::StructFloat*
+        crubit_nonnull __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(
@@ -1190,8 +1200,8 @@ inline void StructFloat::__crubit_field_offset_assertions() {
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_struct_uby_ufloat_upassing_uwith_uno_uthunk_u_uthunkless_ucreate(
-    float,
-    ::structs::struct_by_float_passing_with_no_thunk::StructFloat* __ret_ptr);
+    float, ::structs::struct_by_float_passing_with_no_thunk::StructFloat*
+               crubit_nonnull __ret_ptr);
 }
 inline ::structs::struct_by_float_passing_with_no_thunk::StructFloat
 thunkless_create(float f) {
@@ -1221,7 +1231,8 @@ extern "C" void
 __crubit_thunk_struct_uby_ufloat_upassing_uwith_uno_uthunk_u_uthunkless_umultiply(
     ::structs::struct_by_float_passing_with_no_thunk::StructFloat*,
     ::structs::struct_by_float_passing_with_no_thunk::StructFloat*,
-    ::structs::struct_by_float_passing_with_no_thunk::StructFloat* __ret_ptr);
+    ::structs::struct_by_float_passing_with_no_thunk::StructFloat*
+        crubit_nonnull __ret_ptr);
 }
 inline ::structs::struct_by_float_passing_with_no_thunk::StructFloat
 thunkless_multiply(
@@ -1248,7 +1259,7 @@ static_assert(
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    ::structs::unsupported_types::SomeStruct* __ret_ptr);
+    ::structs::unsupported_types::SomeStruct* crubit_nonnull __ret_ptr);
 }
 inline ::structs::unsupported_types::SomeStruct::SomeStruct() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -1260,7 +1271,8 @@ static_assert(::std::is_trivially_move_assignable_v<
               ::structs::unsupported_types::SomeStruct>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create(
-    rs_std::char_, ::structs::unsupported_types::SomeStruct* __ret_ptr);
+    rs_std::char_,
+    ::structs::unsupported_types::SomeStruct* crubit_nonnull __ret_ptr);
 }
 inline ::structs::unsupported_types::SomeStruct SomeStruct::create(
     rs_std::char_ x) {
@@ -1293,7 +1305,7 @@ inline void ZstFields::__crubit_field_offset_assertions() {
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create(
-    ::std::int32_t, ::structs::zst_fields::ZstFields* __ret_ptr);
+    ::std::int32_t, ::structs::zst_fields::ZstFields* crubit_nonnull __ret_ptr);
 }
 inline ::structs::zst_fields::ZstFields create(::std::int32_t value) {
   crubit::Slot<::structs::zst_fields::ZstFields> __return_value_ret_val_holder;
diff --git a/cc_bindings_from_rs/test/structs/tuple_structs/tuple_structs_cc_api.h b/cc_bindings_from_rs/test/structs/tuple_structs/tuple_structs_cc_api.h
index 6eda7827c..d3a897366 100644
--- a/cc_bindings_from_rs/test/structs/tuple_structs/tuple_structs_cc_api.h
+++ b/cc_bindings_from_rs/test/structs/tuple_structs/tuple_structs_cc_api.h
@@ -756,7 +756,7 @@ inline CloneNoDefault::~CloneNoDefault() {
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone(
     ::tuple_structs::CloneNoDefault const&,
-    ::tuple_structs::CloneNoDefault* __ret_ptr);
+    ::tuple_structs::CloneNoDefault* crubit_nonnull __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(
@@ -793,7 +793,7 @@ static_assert(
     ::std::is_trivially_copy_assignable_v<::tuple_structs::CopyNoDefault>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create(
-    ::std::int32_t, ::tuple_structs::CopyNoDefault* __ret_ptr);
+    ::std::int32_t, ::tuple_structs::CopyNoDefault* crubit_nonnull __ret_ptr);
 }
 inline ::tuple_structs::CopyNoDefault CopyNoDefault::create(
     ::std::int32_t value) {
@@ -813,7 +813,7 @@ static_assert(
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    ::tuple_structs::DefaultAndCloneNoUnpin* __ret_ptr);
+    ::tuple_structs::DefaultAndCloneNoUnpin* crubit_nonnull __ret_ptr);
 }
 inline ::tuple_structs::DefaultAndCloneNoUnpin::DefaultAndCloneNoUnpin() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -826,7 +826,7 @@ static_assert(::std::is_trivially_move_assignable_v<
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone(
     ::tuple_structs::DefaultAndCloneNoUnpin const&,
-    ::tuple_structs::DefaultAndCloneNoUnpin* __ret_ptr);
+    ::tuple_structs::DefaultAndCloneNoUnpin* crubit_nonnull __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(
@@ -855,7 +855,7 @@ static_assert(
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    ::tuple_structs::DefaultNoCopyNoClone* __ret_ptr);
+    ::tuple_structs::DefaultNoCopyNoClone* crubit_nonnull __ret_ptr);
 }
 inline ::tuple_structs::DefaultNoCopyNoClone::DefaultNoCopyNoClone() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -900,7 +900,8 @@ static_assert(::std::is_trivially_copy_assignable_v<
               ::tuple_structs::TupleStructOnePrivateArg>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create(
-    ::std::int32_t, ::tuple_structs::TupleStructOnePrivateArg* __ret_ptr);
+    ::std::int32_t,
+    ::tuple_structs::TupleStructOnePrivateArg* crubit_nonnull __ret_ptr);
 }
 inline ::tuple_structs::TupleStructOnePrivateArg
 TupleStructOnePrivateArg::create(::std::int32_t arg) {
@@ -939,7 +940,8 @@ static_assert(::std::is_trivially_copy_assignable_v<
               ::tuple_structs::TupleStructOnePublicArg>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create(
-    ::std::int32_t, ::tuple_structs::TupleStructOnePublicArg* __ret_ptr);
+    ::std::int32_t,
+    ::tuple_structs::TupleStructOnePublicArg* crubit_nonnull __ret_ptr);
 }
 inline ::tuple_structs::TupleStructOnePublicArg TupleStructOnePublicArg::create(
     ::std::int32_t arg) {
@@ -980,7 +982,8 @@ static_assert(::std::is_trivially_copy_assignable_v<
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create(
     ::std::int32_t, ::std::int32_t,
-    ::tuple_structs::TupleStructOnePublicArgOnePrivateArg* __ret_ptr);
+    ::tuple_structs::TupleStructOnePublicArgOnePrivateArg* crubit_nonnull
+        __ret_ptr);
 }
 inline ::tuple_structs::TupleStructOnePublicArgOnePrivateArg
 TupleStructOnePublicArgOnePrivateArg::create(::std::int32_t first_arg,
@@ -1025,7 +1028,7 @@ static_assert(::std::is_trivially_copy_assignable_v<
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create(
     ::std::int32_t, ::std::int32_t,
-    ::tuple_structs::TupleStructTwoPrivateArgs* __ret_ptr);
+    ::tuple_structs::TupleStructTwoPrivateArgs* crubit_nonnull __ret_ptr);
 }
 inline ::tuple_structs::TupleStructTwoPrivateArgs
 TupleStructTwoPrivateArgs::create(::std::int32_t first_arg,
@@ -1077,7 +1080,7 @@ static_assert(::std::is_trivially_copy_assignable_v<
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create(
     ::std::int32_t, ::std::int32_t,
-    ::tuple_structs::TupleStructTwoPublicArgs* __ret_ptr);
+    ::tuple_structs::TupleStructTwoPublicArgs* crubit_nonnull __ret_ptr);
 }
 inline ::tuple_structs::TupleStructTwoPublicArgs
 TupleStructTwoPublicArgs::create(::std::int32_t first_arg,
@@ -1126,7 +1129,8 @@ inline TupleStructWithCloneNoDefault::~TupleStructWithCloneNoDefault() {
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create(
-    ::std::int32_t, ::tuple_structs::TupleStructWithCloneNoDefault* __ret_ptr);
+    ::std::int32_t,
+    ::tuple_structs::TupleStructWithCloneNoDefault* crubit_nonnull __ret_ptr);
 }
 inline ::tuple_structs::TupleStructWithCloneNoDefault
 TupleStructWithCloneNoDefault::create(::std::int32_t value) {
@@ -1166,7 +1170,7 @@ inline TupleStructWithCppImmovableType::~TupleStructWithCppImmovableType() {
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create(
     ::std::int32_t, ::std::int32_t,
-    ::tuple_structs::TupleStructWithCppImmovableType* __ret_ptr);
+    ::tuple_structs::TupleStructWithCppImmovableType* crubit_nonnull __ret_ptr);
 }
 inline ::tuple_structs::TupleStructWithCppImmovableType
 TupleStructWithCppImmovableType::create(::std::int32_t first_arg,
@@ -1217,7 +1221,8 @@ static_assert(::std::is_trivially_move_assignable_v<
               ::tuple_structs::TupleStructWithDefaultAndCloneNoUnpin>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create(
-    ::tuple_structs::TupleStructWithDefaultAndCloneNoUnpin* __ret_ptr);
+    ::tuple_structs::TupleStructWithDefaultAndCloneNoUnpin* crubit_nonnull
+        __ret_ptr);
 }
 inline ::tuple_structs::TupleStructWithDefaultAndCloneNoUnpin
 TupleStructWithDefaultAndCloneNoUnpin::create() {
@@ -1278,7 +1283,8 @@ static_assert(
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    ::tuple_structs::TupleStructWithNonExhaustiveCtor* __ret_ptr);
+    ::tuple_structs::TupleStructWithNonExhaustiveCtor* crubit_nonnull
+        __ret_ptr);
 }
 inline ::tuple_structs::TupleStructWithNonExhaustiveCtor::
     TupleStructWithNonExhaustiveCtor() {
@@ -1297,7 +1303,8 @@ static_assert(::std::is_trivially_copy_assignable_v<
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create(
     ::std::int32_t, ::std::int32_t,
-    ::tuple_structs::TupleStructWithNonExhaustiveCtor* __ret_ptr);
+    ::tuple_structs::TupleStructWithNonExhaustiveCtor* crubit_nonnull
+        __ret_ptr);
 }
 inline ::tuple_structs::TupleStructWithNonExhaustiveCtor
 TupleStructWithNonExhaustiveCtor::create(::std::int32_t first_arg,
@@ -1322,7 +1329,7 @@ static_assert(
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    ::tuple_structs::TupleStructWithTupleFieldType* __ret_ptr);
+    ::tuple_structs::TupleStructWithTupleFieldType* crubit_nonnull __ret_ptr);
 }
 inline ::tuple_structs::TupleStructWithTupleFieldType::
     TupleStructWithTupleFieldType() {
@@ -1340,7 +1347,8 @@ static_assert(::std::is_trivially_copy_assignable_v<
               ::tuple_structs::TupleStructWithTupleFieldType>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_create(
-    void**, ::tuple_structs::TupleStructWithTupleFieldType* __ret_ptr);
+    void**,
+    ::tuple_structs::TupleStructWithTupleFieldType* crubit_nonnull __ret_ptr);
 }
 inline ::tuple_structs::TupleStructWithTupleFieldType
 TupleStructWithTupleFieldType::create(
@@ -1360,7 +1368,8 @@ TupleStructWithTupleFieldType::create(
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_get_uarg(
-    ::tuple_structs::TupleStructWithTupleFieldType*, void** __ret_ptr);
+    ::tuple_structs::TupleStructWithTupleFieldType*,
+    void** crubit_nonnull __ret_ptr);
 }
 inline ::std::tuple<::std::int32_t, ::std::int32_t>
 TupleStructWithTupleFieldType::get_arg() const {
@@ -1384,7 +1393,7 @@ inline void TupleStructWithTupleFieldType::__crubit_field_offset_assertions() {
 #define _CRUBIT_BINDINGS_FOR_IMPL__x0000003a_x0000003a_x00000020rs_ustd_x00000020_x0000003a_x0000003a_x00000020Tuple_x00000020_x0000003c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020int32_ut_x00000020_x0000002c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020int32_ut_x00000020_x0000003e
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    rs_std::Tuple<::std::int32_t, ::std::int32_t>* __ret_ptr);
+    rs_std::Tuple<::std::int32_t, ::std::int32_t>* crubit_nonnull __ret_ptr);
 }
 inline ::rs_std::Tuple<::std::int32_t, ::std::int32_t>::Tuple() {
   __crubit_internal::__crubit_thunk_default(this);
diff --git a/cc_bindings_from_rs/test/traits/generic_traits_cc_api.h b/cc_bindings_from_rs/test/traits/generic_traits_cc_api.h
index 4b16e2fb2..bb7b9bd44 100644
--- a/cc_bindings_from_rs/test/traits/generic_traits_cc_api.h
+++ b/cc_bindings_from_rs/test/traits/generic_traits_cc_api.h
@@ -162,8 +162,8 @@ static_assert(
 static_assert(
     ::std::is_trivially_move_assignable_v<::generic_traits::StructGeneric>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::int32_t,
-                                   ::generic_traits::StructGeneric* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::std::int32_t, ::generic_traits::StructGeneric* crubit_nonnull __ret_ptr);
 }
 inline ::generic_traits::StructGeneric StructGeneric::new_(::std::int32_t x) {
   crubit::Slot<::generic_traits::StructGeneric> __return_value_ret_val_holder;
diff --git a/cc_bindings_from_rs/test/traits/in_dependent_crate/trait_impl_cc_api.h b/cc_bindings_from_rs/test/traits/in_dependent_crate/trait_impl_cc_api.h
index 77ff03b9b..432593887 100644
--- a/cc_bindings_from_rs/test/traits/in_dependent_crate/trait_impl_cc_api.h
+++ b/cc_bindings_from_rs/test/traits/in_dependent_crate/trait_impl_cc_api.h
@@ -107,8 +107,8 @@ static_assert(::std::is_trivially_destructible_v<MyStruct>);
 static_assert(::std::is_trivially_move_constructible_v<::trait_impl::MyStruct>);
 static_assert(::std::is_trivially_move_assignable_v<::trait_impl::MyStruct>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::int32_t,
-                                   ::trait_impl::MyStruct* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::std::int32_t, ::trait_impl::MyStruct* crubit_nonnull __ret_ptr);
 }
 inline ::trait_impl::MyStruct MyStruct::new_(::std::int32_t x) {
   crubit::Slot<::trait_impl::MyStruct> __return_value_ret_val_holder;
diff --git a/cc_bindings_from_rs/test/traits/stdlib/stdlib_cc_api.h b/cc_bindings_from_rs/test/traits/stdlib/stdlib_cc_api.h
index 1cbc2710f..df8431d58 100644
--- a/cc_bindings_from_rs/test/traits/stdlib/stdlib_cc_api.h
+++ b/cc_bindings_from_rs/test/traits/stdlib/stdlib_cc_api.h
@@ -226,7 +226,8 @@ static_assert(
     alignof(MyStruct) == 4,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::stdlib::MyStruct* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::stdlib::MyStruct* crubit_nonnull __ret_ptr);
 }
 inline ::stdlib::MyStruct::MyStruct() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -243,8 +244,8 @@ inline ::stdlib::MyStruct& ::stdlib::MyStruct::operator=(MyStruct&& other) {
   return *this;
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_clone(::stdlib::MyStruct const&,
-                                     ::stdlib::MyStruct* __ret_ptr);
+extern "C" void __crubit_thunk_clone(
+    ::stdlib::MyStruct const&, ::stdlib::MyStruct* crubit_nonnull __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(::stdlib::MyStruct&,
@@ -261,8 +262,8 @@ inline ::stdlib::MyStruct& ::stdlib::MyStruct::operator=(
   return *this;
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::int32_t,
-                                   ::stdlib::MyStruct* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::std::int32_t, ::stdlib::MyStruct* crubit_nonnull __ret_ptr);
 }
 inline ::stdlib::MyStruct MyStruct::new_(::std::int32_t x) {
   crubit::Slot<::stdlib::MyStruct> __return_value_ret_val_holder;
@@ -271,8 +272,8 @@ inline ::stdlib::MyStruct MyStruct::new_(::std::int32_t x) {
   return ::std::move(__return_value_ret_val_holder).AssumeInitAndTakeValue();
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_from_ui32(::std::int32_t,
-                                         ::stdlib::MyStruct* __ret_ptr);
+extern "C" void __crubit_thunk_from_ui32(
+    ::std::int32_t, ::stdlib::MyStruct* crubit_nonnull __ret_ptr);
 }
 inline MyStruct::MyStruct(::std::int32_t value) {
   __crubit_internal::__crubit_thunk_from_ui32(value, this);
@@ -292,8 +293,8 @@ static_assert(
 static_assert(
     ::std::is_trivially_move_assignable_v<::stdlib::NonCloneableIterator>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::int32_t,
-                                   ::stdlib::NonCloneableIterator* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::std::int32_t, ::stdlib::NonCloneableIterator* crubit_nonnull __ret_ptr);
 }
 inline ::stdlib::NonCloneableIterator NonCloneableIterator::new_(
     ::std::int32_t x) {
@@ -330,7 +331,8 @@ static_assert(::std::is_trivially_move_constructible_v<::stdlib::RefIterator>);
 static_assert(::std::is_trivially_move_assignable_v<::stdlib::RefIterator>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_new(rs_std::SliceRef<const ::std::int32_t>,
-                                   ::stdlib::RefIterator* __ret_ptr);
+                                   ::stdlib::RefIterator* crubit_nonnull
+                                       __ret_ptr);
 }
 inline ::stdlib::RefIterator RefIterator::new_(
     rs_std::SliceRef<const ::std::int32_t> slice) {
@@ -349,7 +351,7 @@ namespace stdlib {
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_Iterator_unext_ustdlib_ugolden_x0000003a_x0000003aMyStruct(
-    ::stdlib::MyStruct&, unsigned char* __ret_ptr);
+    ::stdlib::MyStruct&, unsigned char* crubit_nonnull __ret_ptr);
 }
 }  // namespace stdlib
 inline ::std::optional<::std::int32_t>
@@ -371,7 +373,8 @@ namespace stdlib {
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_ToString_uto_ustring_ustdlib_ugolden_x0000003a_x0000003aMyStruct(
-    ::stdlib::MyStruct const&, ::rs::alloc::string::String* __ret_ptr);
+    ::stdlib::MyStruct const&,
+    ::rs::alloc::string::String* crubit_nonnull __ret_ptr);
 }
 }  // namespace stdlib
 inline ::rs::alloc::string::String
@@ -389,7 +392,7 @@ namespace stdlib {
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_Iterator_unext_ustdlib_ugolden_x0000003a_x0000003aNonCloneableIterator(
-    ::stdlib::NonCloneableIterator&, unsigned char* __ret_ptr);
+    ::stdlib::NonCloneableIterator&, unsigned char* crubit_nonnull __ret_ptr);
 }
 }  // namespace stdlib
 inline ::std::optional<::stdlib::NonCloneableValue>
@@ -411,7 +414,7 @@ namespace stdlib {
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_Iterator_unext_ustdlib_ugolden_x0000003a_x0000003aRefIterator_x0000003c_x00000027a_x0000003e(
-    ::stdlib::RefIterator&, unsigned char* __ret_ptr);
+    ::stdlib::RefIterator&, unsigned char* crubit_nonnull __ret_ptr);
 }
 }  // namespace stdlib
 inline ::std::optional<::std::int32_t const * $a crubit_nonnull>
diff --git a/cc_bindings_from_rs/test/traits/traits_cc_api.h b/cc_bindings_from_rs/test/traits/traits_cc_api.h
index 81c98f6ac..d74161cbd 100644
--- a/cc_bindings_from_rs/test/traits/traits_cc_api.h
+++ b/cc_bindings_from_rs/test/traits/traits_cc_api.h
@@ -372,7 +372,7 @@ static_assert(
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    ::traits::AssociatedTypeStruct* __ret_ptr);
+    ::traits::AssociatedTypeStruct* crubit_nonnull __ret_ptr);
 }
 inline ::traits::AssociatedTypeStruct::AssociatedTypeStruct() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -394,8 +394,9 @@ operator=(AssociatedTypeStruct&& other) {
   return *this;
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_clone(::traits::AssociatedTypeStruct const&,
-                                     ::traits::AssociatedTypeStruct* __ret_ptr);
+extern "C" void __crubit_thunk_clone(
+    ::traits::AssociatedTypeStruct const&,
+    ::traits::AssociatedTypeStruct* crubit_nonnull __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(
@@ -423,7 +424,7 @@ static_assert(
     alignof(Foo) == 4,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::traits::Foo* __ret_ptr);
+extern "C" void __crubit_thunk_default(::traits::Foo* crubit_nonnull __ret_ptr);
 }
 inline ::traits::Foo::Foo() { __crubit_internal::__crubit_thunk_default(this); }
 static_assert(::std::is_trivially_destructible_v<Foo>);
@@ -433,7 +434,7 @@ static_assert(::std::is_trivially_copy_constructible_v<::traits::Foo>);
 static_assert(::std::is_trivially_copy_assignable_v<::traits::Foo>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_new(::std::int32_t, ::std::int32_t,
-                                   ::traits::Foo* __ret_ptr);
+                                   ::traits::Foo* crubit_nonnull __ret_ptr);
 }
 inline ::traits::Foo Foo::new_(::std::int32_t x, ::std::int32_t y) {
   crubit::Slot<::traits::Foo> __return_value_ret_val_holder;
@@ -464,7 +465,8 @@ static_assert(
     alignof(MyStruct) == 4,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::traits::MyStruct* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::traits::MyStruct* crubit_nonnull __ret_ptr);
 }
 inline ::traits::MyStruct::MyStruct() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -475,8 +477,8 @@ static_assert(::std::is_trivially_move_assignable_v<::traits::MyStruct>);
 static_assert(::std::is_trivially_copy_constructible_v<::traits::MyStruct>);
 static_assert(::std::is_trivially_copy_assignable_v<::traits::MyStruct>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::int32_t,
-                                   ::traits::MyStruct* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::std::int32_t, ::traits::MyStruct* crubit_nonnull __ret_ptr);
 }
 inline ::traits::MyStruct MyStruct::new_(::std::int32_t x) {
   crubit::Slot<::traits::MyStruct> __return_value_ret_val_holder;
@@ -494,7 +496,8 @@ static_assert(
     alignof(MyStruct2) == 4,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::traits::MyStruct2* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::traits::MyStruct2* crubit_nonnull __ret_ptr);
 }
 inline ::traits::MyStruct2::MyStruct2() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -524,7 +527,7 @@ static_assert(
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    ::traits::StructWithAssociatedConst* __ret_ptr);
+    ::traits::StructWithAssociatedConst* crubit_nonnull __ret_ptr);
 }
 inline ::traits::StructWithAssociatedConst::StructWithAssociatedConst() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -547,7 +550,7 @@ inline void StructWithAssociatedConst::__crubit_field_offset_assertions() {
 #define _CRUBIT_BINDINGS_FOR_IMPL__x0000003a_x0000003a_x00000020rs_ustd_x00000020_x0000003a_x0000003a_x00000020Tuple_x00000020_x0000003c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020int32_ut_x00000020_x0000002c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020int32_ut_x00000020_x0000003e
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    rs_std::Tuple<::std::int32_t, ::std::int32_t>* __ret_ptr);
+    rs_std::Tuple<::std::int32_t, ::std::int32_t>* crubit_nonnull __ret_ptr);
 }
 inline ::rs_std::Tuple<::std::int32_t, ::std::int32_t>::Tuple() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -596,7 +599,7 @@ namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_AssociatedTypeTrait_uget_uunsupported_uassoc_utype_utraits_ugolden_x0000003a_x0000003aAssociatedTypeStruct(
     ::traits::AssociatedTypeStruct const&,
-    ::rs::alloc::string::String* __ret_ptr);
+    ::rs::alloc::string::String* crubit_nonnull __ret_ptr);
 }
 }  // namespace traits
 inline ::rs::alloc::string::String
@@ -716,7 +719,7 @@ namespace traits {
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_MyTrait_utake_uand_ureturn_uother_utypes_utraits_ugolden_x0000003a_x0000003aMyStruct(
-    ::traits::MyStruct const&, ::traits::Foo*, void** __ret_ptr);
+    ::traits::MyStruct const&, ::traits::Foo*, void** crubit_nonnull __ret_ptr);
 }
 }  // namespace traits
 inline ::std::tuple<::std::int32_t, ::std::int32_t> rs_std::
@@ -796,7 +799,8 @@ namespace traits {
 namespace __crubit_internal {
 extern "C" void
 __crubit_thunk_MyTrait_utake_uand_ureturn_uother_utypes_utraits_ugolden_x0000003a_x0000003aMyStruct2(
-    ::traits::MyStruct2 const&, ::traits::Foo*, void** __ret_ptr);
+    ::traits::MyStruct2 const&, ::traits::Foo*,
+    void** crubit_nonnull __ret_ptr);
 }
 }  // namespace traits
 inline ::std::tuple<::std::int32_t, ::std::int32_t> rs_std::
diff --git a/cc_bindings_from_rs/test/tuples/tuples_cc_api.h b/cc_bindings_from_rs/test/tuples/tuples_cc_api.h
index ee456a8a8..167303898 100644
--- a/cc_bindings_from_rs/test/tuples/tuples_cc_api.h
+++ b/cc_bindings_from_rs/test/tuples/tuples_cc_api.h
@@ -1526,7 +1526,8 @@ static_assert(
 static_assert(::std::is_trivially_move_assignable_v<::tuples::CloneNoDefault>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone(::tuples::CloneNoDefault const&,
-                                     ::tuples::CloneNoDefault* __ret_ptr);
+                                     ::tuples::CloneNoDefault* crubit_nonnull
+                                         __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(::tuples::CloneNoDefault&,
@@ -1543,8 +1544,8 @@ inline ::tuples::CloneNoDefault& ::tuples::CloneNoDefault::operator=(
   return *this;
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::uint8_t,
-                                   ::tuples::CloneNoDefault* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::std::uint8_t, ::tuples::CloneNoDefault* crubit_nonnull __ret_ptr);
 }
 inline ::tuples::CloneNoDefault CloneNoDefault::new_(::std::uint8_t val) {
   crubit::Slot<::tuples::CloneNoDefault> __return_value_ret_val_holder;
@@ -1567,8 +1568,8 @@ static_assert(
 static_assert(
     ::std::is_trivially_move_assignable_v<::tuples::CloneNoDefaultTuple>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::uint8_t,
-                                   ::tuples::CloneNoDefaultTuple* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::std::uint8_t, ::tuples::CloneNoDefaultTuple* crubit_nonnull __ret_ptr);
 }
 inline ::tuples::CloneNoDefaultTuple CloneNoDefaultTuple::new_(
     ::std::uint8_t val) {
@@ -1595,8 +1596,8 @@ static_assert(
     ::std::is_trivially_copy_constructible_v<::tuples::CopyNoDefault>);
 static_assert(::std::is_trivially_copy_assignable_v<::tuples::CopyNoDefault>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::uint8_t,
-                                   ::tuples::CopyNoDefault* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::std::uint8_t, ::tuples::CopyNoDefault* crubit_nonnull __ret_ptr);
 }
 inline ::tuples::CopyNoDefault CopyNoDefault::new_(::std::uint8_t val) {
   crubit::Slot<::tuples::CopyNoDefault> __return_value_ret_val_holder;
@@ -1619,8 +1620,8 @@ static_assert(
 static_assert(
     ::std::is_trivially_move_assignable_v<::tuples::CopyNoDefaultTuple>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::uint8_t,
-                                   ::tuples::CopyNoDefaultTuple* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::std::uint8_t, ::tuples::CopyNoDefaultTuple* crubit_nonnull __ret_ptr);
 }
 inline ::tuples::CopyNoDefaultTuple CopyNoDefaultTuple::new_(
     ::std::uint8_t val) {
@@ -1643,8 +1644,8 @@ static_assert(::std::is_trivially_destructible_v<GetsTuple>);
 static_assert(::std::is_trivially_move_constructible_v<::tuples::GetsTuple>);
 static_assert(::std::is_trivially_move_assignable_v<::tuples::GetsTuple>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::uint32_t,
-                                   ::tuples::GetsTuple* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::std::uint32_t, ::tuples::GetsTuple* crubit_nonnull __ret_ptr);
 }
 inline ::tuples::GetsTuple GetsTuple::new_(::std::uint32_t val) {
   crubit::Slot<::tuples::GetsTuple> __return_value_ret_val_holder;
@@ -1662,7 +1663,8 @@ static_assert(
     alignof(HasDefault) == 8,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::tuples::HasDefault* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::tuples::HasDefault* crubit_nonnull __ret_ptr);
 }
 inline ::tuples::HasDefault::HasDefault() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -1682,8 +1684,8 @@ inline ::tuples::HasDefault& ::tuples::HasDefault::operator=(
   return *this;
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(rs_std::StrRef,
-                                   ::tuples::HasDefault* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    rs_std::StrRef, ::tuples::HasDefault* crubit_nonnull __ret_ptr);
 }
 inline ::tuples::HasDefault HasDefault::new_(rs_std::StrRef val) {
   crubit::Slot<::tuples::HasDefault> __return_value_ret_val_holder;
@@ -1716,8 +1718,8 @@ inline HasDefaultTuple::~HasDefaultTuple() {
   __crubit_internal::__crubit_thunk_drop(*this);
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(rs_std::StrRef,
-                                   ::tuples::HasDefaultTuple* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    rs_std::StrRef, ::tuples::HasDefaultTuple* crubit_nonnull __ret_ptr);
 }
 inline ::tuples::HasDefaultTuple HasDefaultTuple::new_(rs_std::StrRef val) {
   crubit::Slot<::tuples::HasDefaultTuple> __return_value_ret_val_holder;
@@ -1765,8 +1767,8 @@ inline HasNoDefaultTuple::~HasNoDefaultTuple() {
   __crubit_internal::__crubit_thunk_drop(*this);
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(rs_std::StrRef,
-                                   ::tuples::HasNoDefaultTuple* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    rs_std::StrRef, ::tuples::HasNoDefaultTuple* crubit_nonnull __ret_ptr);
 }
 inline ::tuples::HasNoDefaultTuple HasNoDefaultTuple::new_(rs_std::StrRef val) {
   crubit::Slot<::tuples::HasNoDefaultTuple> __return_value_ret_val_holder;
@@ -1820,8 +1822,8 @@ static_assert(
 static_assert(
     ::std::is_trivially_move_assignable_v<::tuples::NestedTupleStruct>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::uint32_t,
-                                   ::tuples::NestedTupleStruct* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::std::uint32_t, ::tuples::NestedTupleStruct* crubit_nonnull __ret_ptr);
 }
 inline ::tuples::NestedTupleStruct NestedTupleStruct::new_(
     ::std::uint32_t val) {
@@ -1856,7 +1858,8 @@ static_assert(
     alignof(NontrivialDrop) == 1,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::tuples::NontrivialDrop* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::tuples::NontrivialDrop* crubit_nonnull __ret_ptr);
 }
 inline ::tuples::NontrivialDrop::NontrivialDrop() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -1892,8 +1895,8 @@ inline StructWithOptionTuple::~StructWithOptionTuple() {
   __crubit_internal::__crubit_thunk_drop(*this);
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::int32_t,
-                                   ::tuples::StructWithOptionTuple* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::std::int32_t, ::tuples::StructWithOptionTuple* crubit_nonnull __ret_ptr);
 }
 inline ::tuples::StructWithOptionTuple StructWithOptionTuple::new_(
     ::std::int32_t val) {
@@ -2045,7 +2048,8 @@ inline void param_triply_nested_tuple(
 }
 
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_return_uadt_uin_utuple(void** __ret_ptr);
+extern "C" void __crubit_thunk_return_uadt_uin_utuple(
+    void** crubit_nonnull __ret_ptr);
 }
 inline ::std::tuple<::tuples::AdtHoldingFiveAndSix> return_adt_in_tuple() {
   crubit::Slot<::tuples::AdtHoldingFiveAndSix> __return_value_0_ret_val_holder;
@@ -2059,7 +2063,7 @@ inline ::std::tuple<::tuples::AdtHoldingFiveAndSix> return_adt_in_tuple() {
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_return_uc_uabi_ucompatible_ufive_uin_utuple(
-    void** __ret_ptr);
+    void** crubit_nonnull __ret_ptr);
 }
 inline ::std::tuple<::std::int32_t> return_c_abi_compatible_five_in_tuple() {
   ::std::int32_t __return_value_0_ret_val_holder;
@@ -2071,7 +2075,8 @@ inline ::std::tuple<::std::int32_t> return_c_abi_compatible_five_in_tuple() {
 }
 
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_return_uffi_ualias_uin_utuple(void** __ret_ptr);
+extern "C" void __crubit_thunk_return_uffi_ualias_uin_utuple(
+    void** crubit_nonnull __ret_ptr);
 }
 inline ::std::tuple<::std::int8_t> return_ffi_alias_in_tuple() {
   ::std::int8_t __return_value_0_ret_val_holder;
@@ -2083,7 +2088,8 @@ inline ::std::tuple<::std::int8_t> return_ffi_alias_in_tuple() {
 }
 
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_return_unested_utuples(void** __ret_ptr);
+extern "C" void __crubit_thunk_return_unested_utuples(
+    void** crubit_nonnull __ret_ptr);
 }
 inline ::std::tuple<::std::tuple<::std::int32_t, ::std::int32_t>,
                     ::std::int32_t>
@@ -2109,7 +2115,7 @@ return_nested_tuples() {
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_return_unew_unontrivial_udrop_uin_utuple(
-    void** __ret_ptr);
+    void** crubit_nonnull __ret_ptr);
 }
 inline ::std::tuple<::tuples::NontrivialDrop>
 return_new_nontrivial_drop_in_tuple() {
@@ -2123,7 +2129,8 @@ return_new_nontrivial_drop_in_tuple() {
 }
 
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_return_uoption_uin_utuple(void** __ret_ptr);
+extern "C" void __crubit_thunk_return_uoption_uin_utuple(
+    void** crubit_nonnull __ret_ptr);
 }
 inline ::std::tuple<::std::optional<::std::int32_t>> return_option_in_tuple() {
   unsigned char __return_value_0_storage
@@ -2142,7 +2149,7 @@ inline ::std::tuple<::std::optional<::std::int32_t>> return_option_in_tuple() {
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_return_uoption_uin_utuple_uref(
     rs_std::Tuple<rs_std::Option<::std::int32_t>> const&,
-    unsigned char* __ret_ptr);
+    unsigned char* crubit_nonnull __ret_ptr);
 }
 inline ::std::optional<::std::int32_t> return_option_in_tuple_ref(
     rs_std::Tuple<rs_std::Option<::std::int32_t>> const& opt) {
@@ -2158,7 +2165,8 @@ inline ::std::optional<::std::int32_t> return_option_in_tuple_ref(
 }
 
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_return_utriply_unested_utuple(void** __ret_ptr);
+extern "C" void __crubit_thunk_return_utriply_unested_utuple(
+    void** crubit_nonnull __ret_ptr);
 }
 inline ::std::tuple<::std::tuple<::std::tuple<::std::int32_t>>>
 return_triply_nested_tuple() {
@@ -2219,7 +2227,7 @@ namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
     rs_std::Tuple<rs_std::Tuple<rs_std::Tuple<::std::uint32_t, ::std::uint32_t>,
                                 ::std::uint32_t>,
-                  ::std::uint32_t>* __ret_ptr);
+                  ::std::uint32_t>* crubit_nonnull __ret_ptr);
 }
 inline ::rs_std::Tuple<
     rs_std::Tuple<rs_std::Tuple<::std::uint32_t, ::std::uint32_t>,
@@ -2284,7 +2292,7 @@ operator std::tuple<
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
     rs_std::Tuple<rs_std::Tuple<::std::uint32_t, ::std::uint32_t>,
-                  ::std::uint32_t>* __ret_ptr);
+                  ::std::uint32_t>* crubit_nonnull __ret_ptr);
 }
 inline ::rs_std::Tuple<rs_std::Tuple<::std::uint32_t, ::std::uint32_t>,
                        ::std::uint32_t>::Tuple() {
@@ -2331,7 +2339,7 @@ operator std::tuple<rs_std::Tuple<::std::uint32_t, ::std::uint32_t>,
 #define _CRUBIT_BINDINGS_FOR_IMPL__x0000003a_x0000003a_x00000020rs_ustd_x00000020_x0000003a_x0000003a_x00000020Tuple_x00000020_x0000003c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020int32_ut_x00000020_x0000003e
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    rs_std::Tuple<::std::int32_t>* __ret_ptr);
+    rs_std::Tuple<::std::int32_t>* crubit_nonnull __ret_ptr);
 }
 inline ::rs_std::Tuple<::std::int32_t>::Tuple() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -2361,7 +2369,7 @@ inline rs_std::Tuple<::std::int32_t>::operator std::tuple<
 #define _CRUBIT_BINDINGS_FOR_IMPL__x0000003a_x0000003a_x00000020rs_ustd_x00000020_x0000003a_x0000003a_x00000020Tuple_x00000020_x0000003c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020int8_ut_x00000020_x0000002c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020intptr_ut_x00000020_x0000003e
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    rs_std::Tuple<::std::int8_t, ::std::intptr_t>* __ret_ptr);
+    rs_std::Tuple<::std::int8_t, ::std::intptr_t>* crubit_nonnull __ret_ptr);
 }
 inline ::rs_std::Tuple<::std::int8_t, ::std::intptr_t>::Tuple() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -2394,7 +2402,7 @@ inline rs_std::Tuple<::std::int8_t, ::std::intptr_t>::operator std::tuple<
 #define _CRUBIT_BINDINGS_FOR_IMPL__x0000003a_x0000003a_x00000020rs_ustd_x00000020_x0000003a_x0000003a_x00000020Tuple_x00000020_x0000003c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020intptr_ut_x00000020_x0000002c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020int8_ut_x00000020_x0000003e
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    rs_std::Tuple<::std::intptr_t, ::std::int8_t>* __ret_ptr);
+    rs_std::Tuple<::std::intptr_t, ::std::int8_t>* crubit_nonnull __ret_ptr);
 }
 inline ::rs_std::Tuple<::std::intptr_t, ::std::int8_t>::Tuple() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -2432,7 +2440,7 @@ extern "C" void __crubit_thunk_clone(
         rs_std::Result<::std::int32_t, ::rs::alloc::string::String>> const&,
     rs_std::Tuple<rs_std::Option<::std::int32_t>,
                   rs_std::Result<::std::int32_t, ::rs::alloc::string::String>>*
-        __ret_ptr);
+        crubit_nonnull __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(
@@ -2505,7 +2513,7 @@ inline rs_std::Tuple<
 #define _CRUBIT_BINDINGS_FOR_IMPL__x0000003a_x0000003a_x00000020rs_ustd_x00000020_x0000003a_x0000003a_x00000020Tuple_x00000020_x0000003c_x00000020rs_ustd_x00000020_x0000003a_x0000003a_x00000020Option_x00000020_x0000003c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020int32_ut_x00000020_x0000003e_x00000020_x0000003e
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    rs_std::Tuple<rs_std::Option<::std::int32_t>>* __ret_ptr);
+    rs_std::Tuple<rs_std::Option<::std::int32_t>>* crubit_nonnull __ret_ptr);
 }
 inline ::rs_std::Tuple<rs_std::Option<::std::int32_t>>::Tuple() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -2537,7 +2545,8 @@ inline rs_std::Tuple<rs_std::Option<::std::int32_t>>::operator std::tuple<
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone(
     rs_std::Tuple<::tuples::CloneNoDefault, ::std::uint8_t> const&,
-    rs_std::Tuple<::tuples::CloneNoDefault, ::std::uint8_t>* __ret_ptr);
+    rs_std::Tuple<::tuples::CloneNoDefault, ::std::uint8_t>* crubit_nonnull
+        __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(
@@ -2606,7 +2615,8 @@ inline rs_std::Tuple<::tuples::CopyNoDefault, ::std::uint8_t>::operator std::
 #define _CRUBIT_BINDINGS_FOR_IMPL__x0000003a_x0000003a_x00000020rs_ustd_x00000020_x0000003a_x0000003a_x00000020Tuple_x00000020_x0000003c_x00000020_x0000003a_x0000003a_x00000020tuples_x00000020_x0000003a_x0000003a_x00000020HasDefault_x00000020_x0000002c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020uint8_ut_x00000020_x0000003e
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    rs_std::Tuple<::tuples::HasDefault, ::std::uint8_t>* __ret_ptr);
+    rs_std::Tuple<::tuples::HasDefault, ::std::uint8_t>* crubit_nonnull
+        __ret_ptr);
 }
 inline ::rs_std::Tuple<::tuples::HasDefault, ::std::uint8_t>::Tuple() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -2657,7 +2667,7 @@ extern "C" void __crubit_thunk_default(
         ::std::uint32_t,
         rs_std::Tuple<::std::uint32_t,
                       rs_std::Tuple<::std::uint32_t, ::std::uint32_t>>>*
-        __ret_ptr);
+        crubit_nonnull __ret_ptr);
 }
 inline ::rs_std::Tuple<
     ::std::uint32_t,
@@ -2730,7 +2740,8 @@ operator std::tuple<
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
     rs_std::Tuple<::std::uint32_t,
-                  rs_std::Tuple<::std::uint32_t, ::std::uint32_t>>* __ret_ptr);
+                  rs_std::Tuple<::std::uint32_t, ::std::uint32_t>>*
+        crubit_nonnull __ret_ptr);
 }
 inline ::rs_std::Tuple<
     ::std::uint32_t, rs_std::Tuple<::std::uint32_t, ::std::uint32_t>>::Tuple() {
@@ -2779,7 +2790,7 @@ operator std::tuple<
 #define _CRUBIT_BINDINGS_FOR_IMPL__x0000003a_x0000003a_x00000020rs_ustd_x00000020_x0000003a_x0000003a_x00000020Tuple_x00000020_x0000003c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020uint32_ut_x00000020_x0000002c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020uint32_ut_x00000020_x0000003e
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    rs_std::Tuple<::std::uint32_t, ::std::uint32_t>* __ret_ptr);
+    rs_std::Tuple<::std::uint32_t, ::std::uint32_t>* crubit_nonnull __ret_ptr);
 }
 inline ::rs_std::Tuple<::std::uint32_t, ::std::uint32_t>::Tuple() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -2813,7 +2824,8 @@ inline rs_std::Tuple<::std::uint32_t, ::std::uint32_t>::operator std::tuple<
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone(
     rs_std::Tuple<::std::uint8_t, ::tuples::CloneNoDefault> const&,
-    rs_std::Tuple<::std::uint8_t, ::tuples::CloneNoDefault>* __ret_ptr);
+    rs_std::Tuple<::std::uint8_t, ::tuples::CloneNoDefault>* crubit_nonnull
+        __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(
@@ -2882,7 +2894,8 @@ inline rs_std::Tuple<::std::uint8_t, ::tuples::CopyNoDefault>::operator std::
 #define _CRUBIT_BINDINGS_FOR_IMPL__x0000003a_x0000003a_x00000020rs_ustd_x00000020_x0000003a_x0000003a_x00000020Tuple_x00000020_x0000003c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020uint8_ut_x00000020_x0000002c_x00000020_x0000003a_x0000003a_x00000020tuples_x00000020_x0000003a_x0000003a_x00000020HasDefault_x00000020_x0000003e
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    rs_std::Tuple<::std::uint8_t, ::tuples::HasDefault>* __ret_ptr);
+    rs_std::Tuple<::std::uint8_t, ::tuples::HasDefault>* crubit_nonnull
+        __ret_ptr);
 }
 inline ::rs_std::Tuple<::std::uint8_t, ::tuples::HasDefault>::Tuple() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -2929,7 +2942,7 @@ inline rs_std::Tuple<::std::uint8_t, ::tuples::HasNoDefault>::~Tuple() {
 #define _CRUBIT_BINDINGS_FOR_IMPL__x0000003a_x0000003a_x00000020rs_ustd_x00000020_x0000003a_x0000003a_x00000020Tuple_x00000020_x0000003c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020uint8_ut_x00000020_x0000002c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020uintptr_ut_x00000020_x0000003e
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    rs_std::Tuple<::std::uint8_t, ::std::uintptr_t>* __ret_ptr);
+    rs_std::Tuple<::std::uint8_t, ::std::uintptr_t>* crubit_nonnull __ret_ptr);
 }
 inline ::rs_std::Tuple<::std::uint8_t, ::std::uintptr_t>::Tuple() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -2962,7 +2975,7 @@ inline rs_std::Tuple<::std::uint8_t, ::std::uintptr_t>::operator std::tuple<
 #define _CRUBIT_BINDINGS_FOR_IMPL__x0000003a_x0000003a_x00000020rs_ustd_x00000020_x0000003a_x0000003a_x00000020Tuple_x00000020_x0000003c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020uintptr_ut_x00000020_x0000002c_x00000020_x0000003a_x0000003a_x00000020std_x00000020_x0000003a_x0000003a_x00000020uint8_ut_x00000020_x0000003e
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    rs_std::Tuple<::std::uintptr_t, ::std::uint8_t>* __ret_ptr);
+    rs_std::Tuple<::std::uintptr_t, ::std::uint8_t>* crubit_nonnull __ret_ptr);
 }
 inline ::rs_std::Tuple<::std::uintptr_t, ::std::uint8_t>::Tuple() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -3131,7 +3144,8 @@ inline constexpr void rs_std::Option<::std::int32_t>::set_tag(
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone(
     rs_std::Result<::std::int32_t, ::rs::alloc::string::String> const&,
-    rs_std::Result<::std::int32_t, ::rs::alloc::string::String>* __ret_ptr);
+    rs_std::Result<::std::int32_t, ::rs::alloc::string::String>* crubit_nonnull
+        __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(
diff --git a/cc_bindings_from_rs/test/type_aliases/type_aliases_cc_api.h b/cc_bindings_from_rs/test/type_aliases/type_aliases_cc_api.h
index f86eb82e5..22ef57cac 100644
--- a/cc_bindings_from_rs/test/type_aliases/type_aliases_cc_api.h
+++ b/cc_bindings_from_rs/test/type_aliases/type_aliases_cc_api.h
@@ -178,7 +178,7 @@ namespace type_aliases::test_generics_matching {
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_returns_uflipped_ualias(
-    rs_std::Result<::std::uint32_t, ::std::int8_t>* __ret_ptr);
+    rs_std::Result<::std::uint32_t, ::std::int8_t>* crubit_nonnull __ret_ptr);
 }
 inline rs_std::Result<::std::uint32_t, ::std::int8_t> returns_flipped_alias() {
   crubit::Slot<rs_std::Result<::std::uint32_t, ::std::int8_t>>
@@ -191,7 +191,7 @@ inline rs_std::Result<::std::uint32_t, ::std::int8_t> returns_flipped_alias() {
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_returns_umatching_ualias(
-    rs_std::Result<::std::int32_t, ::std::int32_t>* __ret_ptr);
+    rs_std::Result<::std::int32_t, ::std::int32_t>* crubit_nonnull __ret_ptr);
 }
 inline rs_std::Result<::std::int32_t, ::std::int32_t> returns_matching_alias() {
   crubit::Slot<rs_std::Result<::std::int32_t, ::std::int32_t>>
@@ -204,7 +204,7 @@ inline rs_std::Result<::std::int32_t, ::std::int32_t> returns_matching_alias() {
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_returns_uspecialized(
-    rs_std::Result<::std::int32_t, ::std::int32_t>* __ret_ptr);
+    rs_std::Result<::std::int32_t, ::std::int32_t>* crubit_nonnull __ret_ptr);
 }
 inline rs_std::Result<::std::int32_t, ::std::int32_t> returns_specialized() {
   crubit::Slot<rs_std::Result<::std::int32_t, ::std::int32_t>>
diff --git a/cc_bindings_from_rs/test/unions/unions_cc_api.h b/cc_bindings_from_rs/test/unions/unions_cc_api.h
index e092bef3c..749006cb1 100644
--- a/cc_bindings_from_rs/test/unions/unions_cc_api.h
+++ b/cc_bindings_from_rs/test/unions/unions_cc_api.h
@@ -107,7 +107,7 @@ union CRUBIT_INTERNAL_RUST_TYPE(":: unions_golden :: repr_c_drop :: U") alignas(
   U(::crubit::UnsafeRelocateTag, U&& value) {
     ::std::memcpy(this, &value, sizeof(value));
   }
-  ::std::int32_t* x;
+  ::std::int32_t* crubit_nullability_unknown x;
 
  private:
   static void __crubit_field_offset_assertions();
@@ -251,12 +251,12 @@ U final {
     ::std::memcpy(this, &value, sizeof(value));
   }
 
-  void set_x(::std::int32_t* x);
+  void set_x(::std::int32_t* crubit_nullability_unknown x);
 
-  ::std::int32_t* get_x() const;
+  ::std::int32_t* crubit_nullability_unknown get_x() const;
 
   struct {
-    ::std::int32_t* value;
+    ::std::int32_t* crubit_nullability_unknown value;
   } x;
 
  private:
@@ -316,7 +316,8 @@ inline void U::__crubit_field_offset_assertions() {
   static_assert(0 == offsetof(U, y));
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_create(::unions::repr_c::U* __ret_ptr);
+extern "C" void __crubit_thunk_create(
+    ::unions::repr_c::U* crubit_nonnull __ret_ptr);
 }
 inline ::unions::repr_c::U create() {
   crubit::Slot<::unions::repr_c::U> __return_value_ret_val_holder;
@@ -341,7 +342,8 @@ static_assert(
 static_assert(::std::is_trivially_move_assignable_v<::unions::repr_c_clone::U>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone(::unions::repr_c_clone::U const&,
-                                     ::unions::repr_c_clone::U* __ret_ptr);
+                                     ::unions::repr_c_clone::U* crubit_nonnull
+                                         __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(::unions::repr_c_clone::U&,
@@ -361,7 +363,8 @@ inline void U::__crubit_field_offset_assertions() {
   static_assert(0 == offsetof(U, x));
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_create(::unions::repr_c_clone::U* __ret_ptr);
+extern "C" void __crubit_thunk_create(
+    ::unions::repr_c_clone::U* crubit_nonnull __ret_ptr);
 }
 inline ::unions::repr_c_clone::U create() {
   crubit::Slot<::unions::repr_c_clone::U> __return_value_ret_val_holder;
@@ -381,7 +384,8 @@ static_assert(
     alignof(U) == 8,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::unions::repr_c_drop::U* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::unions::repr_c_drop::U* crubit_nonnull __ret_ptr);
 }
 inline ::unions::repr_c_drop::U::U() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -421,7 +425,8 @@ inline void U::__crubit_field_offset_assertions() {
   static_assert(0 == offsetof(U, y));
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_create(::unions::repr_c_packed::U* __ret_ptr);
+extern "C" void __crubit_thunk_create(
+    ::unions::repr_c_packed::U* crubit_nonnull __ret_ptr);
 }
 inline ::unions::repr_c_packed::U create() {
   crubit::Slot<::unions::repr_c_packed::U> __return_value_ret_val_holder;
@@ -479,7 +484,8 @@ inline void U::__crubit_field_offset_assertions() {
   static_assert(0 == offsetof(U, y));
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_create(::unions::repr_rust::U* __ret_ptr);
+extern "C" void __crubit_thunk_create(
+    ::unions::repr_rust::U* crubit_nonnull __ret_ptr);
 }
 inline ::unions::repr_rust::U create() {
   crubit::Slot<::unions::repr_rust::U> __return_value_ret_val_holder;
@@ -504,8 +510,9 @@ static_assert(
 static_assert(
     ::std::is_trivially_move_assignable_v<::unions::repr_rust_clone::U>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_clone(::unions::repr_rust_clone::U const&,
-                                     ::unions::repr_rust_clone::U* __ret_ptr);
+extern "C" void __crubit_thunk_clone(
+    ::unions::repr_rust_clone::U const&,
+    ::unions::repr_rust_clone::U* crubit_nonnull __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(::unions::repr_rust_clone::U&,
@@ -542,7 +549,8 @@ inline void U::__crubit_field_offset_assertions() {
   static_assert(0 == offsetof(U, x));
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_create(::unions::repr_rust_clone::U* __ret_ptr);
+extern "C" void __crubit_thunk_create(
+    ::unions::repr_rust_clone::U* crubit_nonnull __ret_ptr);
 }
 inline ::unions::repr_rust_clone::U create() {
   crubit::Slot<::unions::repr_rust_clone::U> __return_value_ret_val_holder;
@@ -562,7 +570,8 @@ static_assert(
     alignof(U) == 8,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::unions::repr_rust_drop::U* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::unions::repr_rust_drop::U* crubit_nonnull __ret_ptr);
 }
 inline ::unions::repr_rust_drop::U::U() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -580,19 +589,19 @@ inline ::unions::repr_rust_drop::U& ::unions::repr_rust_drop::U::operator=(
   return *this;
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_set_ux(::unions::repr_rust_drop::U&,
-                                      ::std::int32_t*);
+extern "C" void __crubit_thunk_set_ux(
+    ::unions::repr_rust_drop::U&, ::std::int32_t* crubit_nullability_unknown);
 }
-inline void U::set_x(::std::int32_t* x) {
+inline void U::set_x(::std::int32_t* crubit_nullability_unknown x) {
   auto&& self = *this;
   return __crubit_internal::__crubit_thunk_set_ux(self, x);
 }
 
 namespace __crubit_internal {
-extern "C" ::std::int32_t* __crubit_thunk_get_ux(
-    ::unions::repr_rust_drop::U const&);
+extern "C" ::std::int32_t* crubit_nullability_unknown
+__crubit_thunk_get_ux(::unions::repr_rust_drop::U const&);
 }
-inline ::std::int32_t* U::get_x() const {
+inline ::std::int32_t* crubit_nullability_unknown U::get_x() const {
   auto&& self = *this;
   return __crubit_internal::__crubit_thunk_get_ux(self);
 }
@@ -619,7 +628,8 @@ inline void U::__crubit_field_offset_assertions() {
   static_assert(0 == offsetof(U, y));
 }
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_create(::unions::repr_rust_packed::U* __ret_ptr);
+extern "C" void __crubit_thunk_create(
+    ::unions::repr_rust_packed::U* crubit_nonnull __ret_ptr);
 }
 inline ::unions::repr_rust_packed::U create() {
   crubit::Slot<::unions::repr_rust_packed::U> __return_value_ret_val_holder;
diff --git a/cc_bindings_from_rs/test/uses/trasitive_reexports/transitive_reexports_cc_api.h b/cc_bindings_from_rs/test/uses/trasitive_reexports/transitive_reexports_cc_api.h
index ad573cfad..9da180fc7 100644
--- a/cc_bindings_from_rs/test/uses/trasitive_reexports/transitive_reexports_cc_api.h
+++ b/cc_bindings_from_rs/test/uses/trasitive_reexports/transitive_reexports_cc_api.h
@@ -50,7 +50,7 @@ namespace transitive_reexports {
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_direct_uto_utransitive(
-    ::direct::Direct const&, ::direct::Transitive* __ret_ptr);
+    ::direct::Direct const&, ::direct::Transitive* crubit_nonnull __ret_ptr);
 }
 inline ::direct::Transitive direct_to_transitive(
     ::direct::Direct const& direct) {
@@ -63,7 +63,8 @@ inline ::direct::Transitive direct_to_transitive(
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_direct_uto_utransitive_uglob_ua(
-    ::direct::Direct const&, ::direct::TransitiveGlobA* __ret_ptr);
+    ::direct::Direct const&,
+    ::direct::TransitiveGlobA* crubit_nonnull __ret_ptr);
 }
 inline ::direct::TransitiveGlobA direct_to_transitive_glob_a(
     ::direct::Direct const& direct) {
@@ -76,7 +77,7 @@ inline ::direct::TransitiveGlobA direct_to_transitive_glob_a(
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_direct_uto_utransitive_uprivate_utype_ualias(
-    ::direct::Direct const&, ::direct::Transitive* __ret_ptr);
+    ::direct::Direct const&, ::direct::Transitive* crubit_nonnull __ret_ptr);
 }
 inline ::direct::Transitive direct_to_transitive_private_type_alias(
     ::direct::Direct const& direct) {
@@ -90,7 +91,7 @@ inline ::direct::Transitive direct_to_transitive_private_type_alias(
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_direct_uto_utransitive_uuse_ualias(
-    ::direct::Direct const&, ::direct::Transitive* __ret_ptr);
+    ::direct::Direct const&, ::direct::Transitive* crubit_nonnull __ret_ptr);
 }
 inline ::direct::Transitive direct_to_transitive_use_alias(
     ::direct::Direct const& direct) {
@@ -103,7 +104,7 @@ inline ::direct::Transitive direct_to_transitive_use_alias(
 
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_direct_uto_utransittive_utype_ualias(
-    ::direct::Direct const&, ::direct::Transitive* __ret_ptr);
+    ::direct::Direct const&, ::direct::Transitive* crubit_nonnull __ret_ptr);
 }
 inline ::direct::Transitive direct_to_transittive_type_alias(
     ::direct::Direct const& direct) {
diff --git a/cc_bindings_from_rs/test/uses/uses_cc_api.h b/cc_bindings_from_rs/test/uses/uses_cc_api.h
index 4ce75160f..063de6814 100644
--- a/cc_bindings_from_rs/test/uses/uses_cc_api.h
+++ b/cc_bindings_from_rs/test/uses/uses_cc_api.h
@@ -183,8 +183,8 @@ static_assert(
 static_assert(
     ::std::is_trivially_move_assignable_v<::uses::AliasOfExportedStruct>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_create(::std::int32_t,
-                                      ::uses::AliasOfExportedStruct* __ret_ptr);
+extern "C" void __crubit_thunk_create(
+    ::std::int32_t, ::uses::AliasOfExportedStruct* crubit_nonnull __ret_ptr);
 }
 inline ::uses::AliasOfExportedStruct AliasOfExportedStruct::create(
     ::std::int32_t field) {
@@ -310,7 +310,8 @@ inline ::std::int32_t private_fn() {
 namespace uses {
 
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_return_ux(::extern_crate::X* __ret_ptr);
+extern "C" void __crubit_thunk_return_ux(
+    ::extern_crate::X* crubit_nonnull __ret_ptr);
 }
 inline ::extern_crate::X return_x() {
   crubit::Slot<::extern_crate::X> __return_value_ret_val_holder;
@@ -320,7 +321,8 @@ inline ::extern_crate::X return_x() {
 }
 
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_return_uy(::extern_crate::Y* __ret_ptr);
+extern "C" void __crubit_thunk_return_uy(
+    ::extern_crate::Y* crubit_nonnull __ret_ptr);
 }
 inline ::extern_crate::Y return_y() {
   crubit::Slot<::extern_crate::Y> __return_value_ret_val_holder;
diff --git a/cc_bindings_from_rs/test/uses_reexport/uses_reexport_cc_api.h b/cc_bindings_from_rs/test/uses_reexport/uses_reexport_cc_api.h
index 852b77abf..086407fd8 100644
--- a/cc_bindings_from_rs/test/uses_reexport/uses_reexport_cc_api.h
+++ b/cc_bindings_from_rs/test/uses_reexport/uses_reexport_cc_api.h
@@ -211,7 +211,8 @@ static_assert(::std::is_trivially_destructible_v<Foo>);
 static_assert(::std::is_trivially_move_constructible_v<::uses_reexport::Foo>);
 static_assert(::std::is_trivially_move_assignable_v<::uses_reexport::Foo>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_create(::uses_reexport::Foo* __ret_ptr);
+extern "C" void __crubit_thunk_create(
+    ::uses_reexport::Foo* crubit_nonnull __ret_ptr);
 }
 inline ::uses_reexport::Foo Foo::create() {
   crubit::Slot<::uses_reexport::Foo> __return_value_ret_val_holder;
@@ -221,7 +222,8 @@ inline ::uses_reexport::Foo Foo::create() {
 }
 
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_bar(::uses_reexport::Bar* __ret_ptr);
+extern "C" void __crubit_thunk_bar(
+    ::uses_reexport::Bar* crubit_nonnull __ret_ptr);
 }
 inline ::uses_reexport::Bar Foo::bar() {
   crubit::Slot<::uses_reexport::Bar> __return_value_ret_val_holder;
diff --git a/common/test/bidirectional_deps/leaf_rs_lib_cc_api.h b/common/test/bidirectional_deps/leaf_rs_lib_cc_api.h
index dd7c28c1e..b8bebbc89 100644
--- a/common/test/bidirectional_deps/leaf_rs_lib_cc_api.h
+++ b/common/test/bidirectional_deps/leaf_rs_lib_cc_api.h
@@ -148,7 +148,8 @@ static_assert(
     alignof(LeafRsType) == 1,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::leaf_rs_lib::LeafRsType* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::leaf_rs_lib::LeafRsType* crubit_nonnull __ret_ptr);
 }
 inline ::leaf_rs_lib::LeafRsType::LeafRsType() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -179,8 +180,8 @@ inline ::std::uint8_t unwrap_enum(::leaf_rs_lib::LeafRsEnum x) {
 }
 
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_wrap(::std::uint8_t,
-                                    ::leaf_rs_lib::LeafRsType* __ret_ptr);
+extern "C" void __crubit_thunk_wrap(
+    ::std::uint8_t, ::leaf_rs_lib::LeafRsType* crubit_nonnull __ret_ptr);
 }
 inline ::leaf_rs_lib::LeafRsType wrap(::std::uint8_t x) {
   crubit::Slot<::leaf_rs_lib::LeafRsType> __return_value_ret_val_holder;
@@ -190,8 +191,8 @@ inline ::leaf_rs_lib::LeafRsType wrap(::std::uint8_t x) {
 }
 
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_wrap_uenum(::std::uint8_t,
-                                          ::leaf_rs_lib::LeafRsEnum* __ret_ptr);
+extern "C" void __crubit_thunk_wrap_uenum(
+    ::std::uint8_t, ::leaf_rs_lib::LeafRsEnum* crubit_nonnull __ret_ptr);
 }
 inline ::leaf_rs_lib::LeafRsEnum wrap_enum(::std::uint8_t x) {
   crubit::Slot<::leaf_rs_lib::LeafRsEnum> __return_value_ret_val_holder;
diff --git a/examples/rust/enum/example_generated.h b/examples/rust/enum/example_generated.h
index 21fb27929..21890410a 100644
--- a/examples/rust/enum/example_generated.h
+++ b/examples/rust/enum/example_generated.h
@@ -70,7 +70,8 @@ static_assert(
     alignof(Color) == 1,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::example_crate::Color* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::example_crate::Color* crubit_nonnull __ret_ptr);
 }
 inline ::example_crate::Color::Color() {
   __crubit_internal::__crubit_thunk_default(this);
diff --git a/examples/rust/enum_with_payload/example_generated.h b/examples/rust/enum_with_payload/example_generated.h
index db82eb848..5d13154a3 100644
--- a/examples/rust/enum_with_payload/example_generated.h
+++ b/examples/rust/enum_with_payload/example_generated.h
@@ -83,8 +83,8 @@ inline constexpr Color Color::MakeTransparent() {
 }
 
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_Grayscale(::std::uint8_t,
-                                         ::example_crate::Color* __ret_ptr);
+extern "C" void __crubit_thunk_Grayscale(
+    ::std::uint8_t, ::example_crate::Color* crubit_nonnull __ret_ptr);
 }
 inline ::example_crate::Color Color::MakeGrayscale(::std::uint8_t __param_0) {
   crubit::Slot<::example_crate::Color> __return_value_ret_val_holder;
@@ -95,9 +95,9 @@ inline ::example_crate::Color Color::MakeGrayscale(::std::uint8_t __param_0) {
 }
 
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_Rgb(::std::uint8_t, ::std::uint8_t,
-                                   ::std::uint8_t,
-                                   ::example_crate::Color* __ret_ptr);
+extern "C" void __crubit_thunk_Rgb(
+    ::std::uint8_t, ::std::uint8_t, ::std::uint8_t,
+    ::example_crate::Color* crubit_nonnull __ret_ptr);
 }
 inline ::example_crate::Color Color::MakeRgb(::std::uint8_t __param_0,
                                              ::std::uint8_t __param_1,
diff --git a/examples/rust/non_trivial_struct/example_generated.h b/examples/rust/non_trivial_struct/example_generated.h
index 57cb39117..bfc96ff37 100644
--- a/examples/rust/non_trivial_struct/example_generated.h
+++ b/examples/rust/non_trivial_struct/example_generated.h
@@ -61,7 +61,7 @@ static_assert(
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    ::example_crate::NonTrivialStruct* __ret_ptr);
+    ::example_crate::NonTrivialStruct* crubit_nonnull __ret_ptr);
 }
 inline ::example_crate::NonTrivialStruct::NonTrivialStruct() {
   __crubit_internal::__crubit_thunk_default(this);
diff --git a/examples/rust/rust_union/example_generated.h b/examples/rust/rust_union/example_generated.h
index ba09ceaa4..2b5f01ae5 100644
--- a/examples/rust/rust_union/example_generated.h
+++ b/examples/rust/rust_union/example_generated.h
@@ -67,7 +67,7 @@ static_assert(
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_default(
-    ::example_crate::ReprRustUnion* __ret_ptr);
+    ::example_crate::ReprRustUnion* crubit_nonnull __ret_ptr);
 }
 inline ::example_crate::ReprRustUnion::ReprRustUnion() {
   __crubit_internal::__crubit_thunk_default(this);
diff --git a/examples/rust/struct/example_generated.h b/examples/rust/struct/example_generated.h
index fc783e5a4..52f12fef7 100644
--- a/examples/rust/struct/example_generated.h
+++ b/examples/rust/struct/example_generated.h
@@ -59,7 +59,8 @@ static_assert(
     alignof(Struct) == 4,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::example_crate::Struct* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::example_crate::Struct* crubit_nonnull __ret_ptr);
 }
 inline ::example_crate::Struct::Struct() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -70,7 +71,8 @@ static_assert(
 static_assert(::std::is_trivially_move_assignable_v<::example_crate::Struct>);
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone(::example_crate::Struct const&,
-                                     ::example_crate::Struct* __ret_ptr);
+                                     ::example_crate::Struct* crubit_nonnull
+                                         __ret_ptr);
 }
 namespace __crubit_internal {
 extern "C" void __crubit_thunk_clone_ufrom(::example_crate::Struct&,
diff --git a/examples/rust/trait/example_generated.h b/examples/rust/trait/example_generated.h
index 607f95461..c849f978e 100644
--- a/examples/rust/trait/example_generated.h
+++ b/examples/rust/trait/example_generated.h
@@ -83,7 +83,8 @@ static_assert(
     alignof(MyStruct) == 4,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::example_crate::MyStruct* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::example_crate::MyStruct* crubit_nonnull __ret_ptr);
 }
 inline ::example_crate::MyStruct::MyStruct() {
   __crubit_internal::__crubit_thunk_default(this);
@@ -96,8 +97,8 @@ static_assert(
     ::std::is_trivially_copy_constructible_v<::example_crate::MyStruct>);
 static_assert(::std::is_trivially_copy_assignable_v<::example_crate::MyStruct>);
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_new(::std::int32_t,
-                                   ::example_crate::MyStruct* __ret_ptr);
+extern "C" void __crubit_thunk_new(
+    ::std::int32_t, ::example_crate::MyStruct* crubit_nonnull __ret_ptr);
 }
 inline ::example_crate::MyStruct MyStruct::new_(::std::int32_t x) {
   crubit::Slot<::example_crate::MyStruct> __return_value_ret_val_holder;
diff --git a/examples/rust/union/example_generated.h b/examples/rust/union/example_generated.h
index 07342ea49..f1cb26d98 100644
--- a/examples/rust/union/example_generated.h
+++ b/examples/rust/union/example_generated.h
@@ -56,7 +56,8 @@ static_assert(
     alignof(ReprCUnion) == 8,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::example_crate::ReprCUnion* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::example_crate::ReprCUnion* crubit_nonnull __ret_ptr);
 }
 inline ::example_crate::ReprCUnion::ReprCUnion() {
   __crubit_internal::__crubit_thunk_default(this);
diff --git a/examples/rust/use_declaration/example_generated.h b/examples/rust/use_declaration/example_generated.h
index ef745e8b9..e4228045c 100644
--- a/examples/rust/use_declaration/example_generated.h
+++ b/examples/rust/use_declaration/example_generated.h
@@ -68,7 +68,8 @@ static_assert(
     alignof(Type) == 4,
     "Verify that ADT layout didn't change since this header got generated");
 namespace __crubit_internal {
-extern "C" void __crubit_thunk_default(::example_crate::Type* __ret_ptr);
+extern "C" void __crubit_thunk_default(
+    ::example_crate::Type* crubit_nonnull __ret_ptr);
 }
 inline ::example_crate::Type::Type() {
   __crubit_internal::__crubit_thunk_default(this);
diff --git a/support/annotations_internal.h b/support/annotations_internal.h
index a53eba3e5..5bfc7eea3 100644
--- a/support/annotations_internal.h
+++ b/support/annotations_internal.h
@@ -18,11 +18,15 @@
 #define CRUBIT_LIFETIME_BOUND
 #endif
 #define crubit_nonnull _Nonnull
+#define crubit_nullable _Nullable
+#define crubit_nullability_unknown _Null_unspecified
 #else
 #define CRUBIT_TRIVIAL_ABI
 #define CRUBIT_VIEW
 #define CRUBIT_LIFETIME_BOUND
 #define crubit_nonnull
+#define crubit_nullable
+#define crubit_nullability_unknown
 #endif
 
 // Style waiver granted in crubit.rs-style-waiver-attribute-annotate
diff --git a/support/rs_std/slice_ref.h b/support/rs_std/slice_ref.h
index cf26b56ae..0c3224742 100644
--- a/support/rs_std/slice_ref.h
+++ b/support/rs_std/slice_ref.h
@@ -125,7 +125,9 @@ class CRUBIT_INTERNAL_RUST_TYPE("&[]", T) CRUBIT_TRIVIAL_ABI CRUBIT_VIEW
   constexpr SliceRef& operator=(SliceRef&&) noexcept = default;
   ~SliceRef() = default;
 
-  constexpr T* data() const noexcept { return size_ > 0 ? ptr_ : nullptr; }
+  constexpr T* crubit_nullability_unknown data() const noexcept {
+    return size_ > 0 ? ptr_ : nullptr;
+  }
   constexpr size_t size() const noexcept { return size_; }
 
   CRUBIT_DO_NOT_BIND constexpr std::span<T> to_span() const noexcept {
@@ -141,7 +143,7 @@ class CRUBIT_INTERNAL_RUST_TYPE("&[]", T) CRUBIT_TRIVIAL_ABI CRUBIT_VIEW
   // `dangling_ptr_` is never read from in C++, and `ptr_` must only ever be
   // read from when `size_ > 0`.
   union {
-    T* ptr_;
+    T* crubit_nonnull ptr_;
     uintptr_t dangling_ptr_;
   };
   size_t size_;
diff --git a/support/rs_std/str_ref.h b/support/rs_std/str_ref.h
index 86e2a9c47..87fa93d3b 100644
--- a/support/rs_std/str_ref.h
+++ b/support/rs_std/str_ref.h
@@ -118,7 +118,9 @@ class CRUBIT_INTERNAL_RUST_TYPE("&str") CRUBIT_TRIVIAL_ABI StrRef final {
   constexpr size_t len() const noexcept { return slice_.size(); }
   constexpr bool empty() const noexcept { return slice_.size() == 0; }
 
-  constexpr const char* data() const noexcept { return slice_.data(); }
+  constexpr const char* crubit_nullability_unknown data() const noexcept {
+    return slice_.data();
+  }
   constexpr size_t size() const noexcept { return slice_.size(); }
 
   constexpr std::string_view to_string_view() const noexcept {
@@ -158,11 +160,11 @@ constexpr bool operator==(std::string_view lhs, StrRef rhs) noexcept {
   return rhs == lhs;
 }
 
-constexpr bool operator==(StrRef lhs, const char* rhs) noexcept {
+constexpr bool operator==(StrRef lhs, const char* crubit_nonnull rhs) noexcept {
   return lhs.to_string_view() == std::string_view(rhs);
 }
 
-constexpr bool operator==(const char* lhs, StrRef rhs) noexcept {
+constexpr bool operator==(const char* crubit_nonnull lhs, StrRef rhs) noexcept {
   return rhs == lhs;
 }
 
@@ -178,11 +180,13 @@ constexpr auto operator<=>(std::string_view lhs, StrRef rhs) noexcept {
   return lhs <=> rhs.to_string_view();
 }
 
-constexpr auto operator<=>(StrRef lhs, const char* rhs) noexcept {
+constexpr auto operator<=>(StrRef lhs,
+                           const char* crubit_nonnull rhs) noexcept {
   return lhs.to_string_view() <=> std::string_view(rhs);
 }
 
-constexpr auto operator<=>(const char* lhs, StrRef rhs) noexcept {
+constexpr auto operator<=>(const char* crubit_nonnull lhs,
+                           StrRef rhs) noexcept {
   return std::string_view(lhs) <=> rhs.to_string_view();
 }