diff --git a/src/common/src/mlib/ckdint.h b/src/common/src/mlib/ckdint.h
index 85e0b75641..608510c13f 100644
--- a/src/common/src/mlib/ckdint.h
+++ b/src/common/src/mlib/ckdint.h
@@ -5,9 +5,6 @@
  *
  * This file implements the C23 checked-integer-arithmetic functions as macros.
  *
- * The implementation is nearly perfect: The macros necessarily evaluate the
- * operand expressions more than once, so callers should be aware of this caveat.
- *
  * The function-like macros are defined:
  *
  * - `mlib_add(Dst, L, R)` / `mlib_add(Dst, A)`
@@ -159,7 +156,7 @@ mlib_extern_c_begin ();
  * @param T A type specifier for a target integral type for the cast.
  * @param Operand The integral value to be converted.
  *
- * If the cast would result in the operand value chaning, the program will be
+ * If the cast would result in the operand value changing, the program will be
  * terminated with a diagnostic.
  */
 #define mlib_assert_narrow(T, Operand) \
diff --git a/src/common/src/mlib/ckdint.test.cpp b/src/common/src/mlib/ckdint.test.cpp
index dbd94303d7..24434c218a 100644
--- a/src/common/src/mlib/ckdint.test.cpp
+++ b/src/common/src/mlib/ckdint.test.cpp
@@ -14,6 +14,9 @@
 #endif // __has_builtin
 #endif
 
+static_assert (mlib_upsize_integer (42ll).is_signed, "mlib_upsize_integer yielded the wrong answer");
+static_assert (!mlib_upsize_integer (42ull).is_signed, "mlib_upsize_integer yielded the wrong answer");
+
 template <typename... Ts> struct typelist {
 };
 using integer_types = typelist<char,
diff --git a/src/common/src/mlib/cmp.h b/src/common/src/mlib/cmp.h
index a0c03947b8..ac167769c1 100644
--- a/src/common/src/mlib/cmp.h
+++ b/src/common/src/mlib/cmp.h
@@ -46,9 +46,6 @@ enum mlib_cmp_result {
 /**
  * @brief Compare two integral values safely.
  *
- * NOTE: This macro may evaluate the operand expressions more than once! Do not
- * use expressions that are expensive or have side effects!
- *
  * This function can be called with two arguments or with three:
  *
  * - `mlib_cmp(a, b)` Returns a value of type `mlib_cmp_result`
diff --git a/src/common/src/mlib/intutil.h b/src/common/src/mlib/intutil.h
index 377046c2e6..9bb0f84460 100644
--- a/src/common/src/mlib/intutil.h
+++ b/src/common/src/mlib/intutil.h
@@ -83,19 +83,25 @@ typedef struct mlib_upsized_integer {
  * an i64 losslessly.
  *
  * If the integer to upcast is the same size as `intmax_t`, we need to decide whether to store
- * it as unsigned. The expression `(0 & Value) - 1 < 0` will be `true` iff the operand is signed,
+ * it as unsigned. The expression `(_mlibGetOne(Value)) - 2 < 1` will be `true` iff the operand is signed,
  * otherwise false. If the operand is signed, we can safely cast to `intmax_t` (it probably already
  * is of that type), otherwise, we can to `uintmax_t` and the returned `mlib_upsized_integer` will
- * indicate that the stored value is unsigned.
+ * indicate that the stored value is unsigned. The expression `1 - 2 < 1` is chosen
+ * to avoid `-Wtype-limits` warnings from some compilers about unsigned comparison.
  */
 #define mlib_upsize_integer(Value) \
-   /* NOLINTNEXTLINE(bugprone-sizeof-expression) */ \
    MLIB_PRAGMA_IF_MSVC (warning(push)) \
    MLIB_PRAGMA_IF_MSVC (warning(disable : 4189)) \
-   ((sizeof ((Value)) < sizeof (intmax_t) || ((0 & (Value)) - 1) < 0) \
+   /* NOLINTNEXTLINE(bugprone-sizeof-expression) */ \
+   ((sizeof ((Value)) < sizeof (intmax_t) || (_mlibGetOne(Value) - 2) < _mlibGetOne(Value)) \
       ? mlib_init(mlib_upsized_integer) {{(intmax_t) (Value)}, true} \
       : mlib_init(mlib_upsized_integer) {{(intmax_t) (uintmax_t) (Value)}}) \
    MLIB_PRAGMA_IF_MSVC (warning(pop))
+// Yield a 1 value of similar-ish type to the given expression. The ternary
+// forces an integer promotion of literal 1 match the type of `V`, while leaving
+// `V` unevaluated. Note that this will also promote `V` to be at least `(unsigned) int`,
+// so the 1 value is only "similar" to `V`, and may be of a larger type
+#define _mlibGetOne(V) (1 ? 1 : (V))
 // clang-format on
 
 #endif // MLIB_INTUTIL_H_INCLUDED
diff --git a/src/common/tests/test-mlib.c b/src/common/tests/test-mlib.c
index c2bd376069..d7447303c9 100644
--- a/src/common/tests/test-mlib.c
+++ b/src/common/tests/test-mlib.c
@@ -314,6 +314,14 @@ _test_cmp (void)
    mlib_diagnostic_pop ();
    // mlib_cmp produces the correct answer:
    ASSERT (mlib_cmp (-27, <, 20u));
+
+   {
+      // Check that we do not double-evaluate the operand expression.
+      intmax_t a = 4;
+      mlib_check (mlib_cmp (++a, ==, 5));
+      // We only increment once:
+      mlib_check (a, eq, 5);
+   }
 }
 
 static void
diff --git a/src/libmongoc/src/mongoc/mongoc-scram.c b/src/libmongoc/src/mongoc/mongoc-scram.c
index 2c199c9f43..4889abbac3 100644
--- a/src/libmongoc/src/mongoc/mongoc-scram.c
+++ b/src/libmongoc/src/mongoc/mongoc-scram.c
@@ -565,6 +565,7 @@ _mongoc_scram_step2 (mongoc_scram_t *scram,
        * MD5( UTF8( username + ':mongo:' + plain_text_password )))" */
       tmp = bson_strdup_printf ("%s:mongo:%s", scram->user, scram->pass);
       hashed_password = _mongoc_hex_md5 (tmp);
+      BSON_ASSERT (hashed_password);
       bson_zero_free (tmp, strlen (tmp));
    } else if (scram->crypto.algorithm == MONGOC_CRYPTO_ALGORITHM_SHA_256) {
       /* Auth spec for SCRAM-SHA-256: "Passwords MUST be prepared with SASLprep,
@@ -743,9 +744,7 @@ _mongoc_scram_step2 (mongoc_scram_t *scram,
    }
 
    /* Save the presecrets for caching */
-   if (hashed_password) {
-      bson_strncpy (scram->hashed_password, hashed_password, sizeof (scram->hashed_password));
-   }
+   bson_strncpy (scram->hashed_password, hashed_password, sizeof (scram->hashed_password));
 
    scram->iterations = iterations;
    memcpy (scram->decoded_salt, decoded_salt, sizeof (scram->decoded_salt));