diff --git a/client/src/main.rs b/client/src/main.rs
index 04cd38a..2d0094c 100644
--- a/client/src/main.rs
+++ b/client/src/main.rs
@@ -364,7 +364,7 @@ fn redeem_invite(
         .resolve()
         .with_str(config.server.external_endpoint.to_string())?;
     wg::up(
-        &iface,
+        iface,
         &config.interface.private_key,
         config.interface.address,
         None,
@@ -402,7 +402,7 @@ fn redeem_invite(
     log::info!("Changing keys and waiting for server's WireGuard interface to transition.",);
     DeviceUpdate::new()
         .set_private_key(keypair.private)
-        .apply(&iface, network.backend)
+        .apply(iface, network.backend)
         .with_str(iface.to_string())?;
     thread::sleep(*REDEEM_TRANSITION_WAIT);
 
@@ -469,11 +469,11 @@ fn fetch(
     }
 
     log::info!("fetching state from server.");
-    let mut store = DataStore::open_or_create(&interface)?;
+    let mut store = DataStore::open_or_create(interface)?;
     let State { peers, cidrs } = Api::new(&config.server).http("GET", "/user/state")?;
 
     let device_info =
-        Device::get(&interface, network.backend).with_str(interface.as_str_lossy())?;
+        Device::get(interface, network.backend).with_str(interface.as_str_lossy())?;
     let interface_public_key = device_info
         .public_key
         .as_ref()
@@ -533,7 +533,7 @@ fn fetch(
 
     if device_config_changed {
         device_config_builder
-            .apply(&interface, network.backend)
+            .apply(interface, network.backend)
             .with_str(interface.to_string())?;
 
         if let Some(path) = hosts_path {
@@ -936,7 +936,7 @@ fn print_tree(cidr: &CidrTree, peers: &[PeerState], level: usize) {
     children.sort();
     children
         .iter()
-        .for_each(|child| print_tree(&child, peers, level + 1));
+        .for_each(|child| print_tree(child, peers, level + 1));
 
     for peer in peers.iter().filter(|p| p.peer.cidr_id == cidr.id) {
         print_peer(peer, true, level);
diff --git a/server/src/db/peer.rs b/server/src/db/peer.rs
index 3e1a487..5f729a0 100644
--- a/server/src/db/peer.rs
+++ b/server/src/db/peer.rs
@@ -75,7 +75,7 @@ impl DatabasePeer {
         } = &contents;
         log::info!("creating peer {:?}", contents);
 
-        if !Self::is_valid_name(&name) {
+        if !Self::is_valid_name(name) {
             log::warn!("peer name is invalid, must conform to hostname(7) requirements.");
             return Err(ServerError::InvalidQuery);
         }
diff --git a/server/src/initialize.rs b/server/src/initialize.rs
index 1b4e20d..e440071 100644
--- a/server/src/initialize.rs
+++ b/server/src/initialize.rs
@@ -57,7 +57,7 @@ fn populate_database(conn: &Connection, db_init_data: DbInitData) -> Result<(),
     const SERVER_NAME: &str = "innernet-server";
 
     let root_cidr = DatabaseCidr::create(
-        &conn,
+        conn,
         CidrContents {
             name: db_init_data.network_name.clone(),
             cidr: db_init_data.network_cidr,
@@ -67,7 +67,7 @@ fn populate_database(conn: &Connection, db_init_data: DbInitData) -> Result<(),
     .map_err(|_| anyhow!("failed to create root CIDR"))?;
 
     let server_cidr = DatabaseCidr::create(
-        &conn,
+        conn,
         CidrContents {
             name: SERVER_NAME.into(),
             cidr: db_init_data.server_cidr,
@@ -77,7 +77,7 @@ fn populate_database(conn: &Connection, db_init_data: DbInitData) -> Result<(),
     .map_err(|_| anyhow!("failed to create innernet-server CIDR"))?;
 
     let _me = DatabasePeer::create(
-        &conn,
+        conn,
         PeerContents {
             name: SERVER_NAME.parse().map_err(|e: &str| anyhow!(e))?,
             ip: db_init_data.our_ip,
diff --git a/server/src/main.rs b/server/src/main.rs
index baeb399..5157ffe 100644
--- a/server/src/main.rs
+++ b/server/src/main.rs
@@ -263,7 +263,7 @@ fn open_database_connection(
     interface: &InterfaceName,
     conf: &ServerConfig,
 ) -> Result<rusqlite::Connection, Error> {
-    let database_path = conf.database_path(&interface);
+    let database_path = conf.database_path(interface);
     if !Path::new(&database_path).exists() {
         bail!(
             "no database file found at {}",
@@ -612,7 +612,7 @@ fn get_session(
         .get(INNERNET_PUBKEY_HEADER)
         .ok_or(ServerError::Unauthorized)?;
     let pubkey = pubkey.to_str().map_err(|_| ServerError::Unauthorized)?;
-    let pubkey = Key::from_base64(&pubkey).map_err(|_| ServerError::Unauthorized)?;
+    let pubkey = Key::from_base64(pubkey).map_err(|_| ServerError::Unauthorized)?;
     if pubkey.0.ct_eq(&context.public_key.0).into() {
         let peer = DatabasePeer::get_from_ip(&context.db.lock(), addr).map_err(|e| match e {
             rusqlite::Error::QueryReturnedNoRows => ServerError::Unauthorized,
diff --git a/shared/src/wg.rs b/shared/src/wg.rs
index cf4520a..428df7a 100644
--- a/shared/src/wg.rs
+++ b/shared/src/wg.rs
@@ -78,7 +78,7 @@ pub fn up(
     if let Some((public_key, address, endpoint)) = peer {
         let prefix = if address.is_ipv4() { 32 } else { 128 };
         let peer_config =
-            PeerConfigBuilder::new(&wgctrl::Key::from_base64(&public_key).map_err(|_| {
+            PeerConfigBuilder::new(&wgctrl::Key::from_base64(public_key).map_err(|_| {
                 io::Error::new(
                     io::ErrorKind::InvalidInput,
                     "failed to parse base64 public key",
@@ -92,7 +92,7 @@ pub fn up(
         device = device.set_listen_port(listen_port);
     }
     device
-        .set_private_key(wgctrl::Key::from_base64(&private_key).unwrap())
+        .set_private_key(wgctrl::Key::from_base64(private_key).unwrap())
         .apply(interface, network.backend)?;
     set_addr(interface, address)?;
     set_up(