diff --git a/src/workerd/api/cache.c++ b/src/workerd/api/cache.c++
index 68f394ce35a..6a978149b34 100644
--- a/src/workerd/api/cache.c++
+++ b/src/workerd/api/cache.c++
@@ -533,7 +533,7 @@ kj::Own<kj::HttpClient> Cache::getHttpClient(
 // =======================================================================================
 // CacheStorage
 
-CacheStorage::CacheStorage(): default_(jsg::alloc<Cache>(nullptr)) {}
+CacheStorage::CacheStorage(): default_(jsg::alloc<Cache>(kj::none)) {}
 
 jsg::Promise<jsg::Ref<Cache>> CacheStorage::open(jsg::Lock& js, kj::String cacheName) {
   // Set some reasonable limit to prevent scripts from blowing up our control header size.
diff --git a/src/workerd/api/http.c++ b/src/workerd/api/http.c++
index 8a371457462..dee5c5113e5 100644
--- a/src/workerd/api/http.c++
+++ b/src/workerd/api/http.c++
@@ -1500,7 +1500,7 @@ jsg::Ref<Response> Response::redirect(jsg::Lock& js, kj::String url, jsg::Option
   auto statusText = defaultStatusText(statusCode);
 
   return jsg::alloc<Response>(
-      js, statusCode, kj::str(statusText), kj::mv(headers), nullptr, nullptr);
+      js, statusCode, kj::str(statusText), kj::mv(headers), nullptr, kj::none);
 }
 
 jsg::Ref<Response> Response::json_(
@@ -2448,7 +2448,7 @@ jsg::Promise<Fetcher::QueueResult> Fetcher::queue(
   auto encodedMessages = kj::heapArrayBuilder<IncomingQueueMessage>(messages.size());
   for (auto& msg: messages) {
     KJ_IF_SOME(b, msg.body) {
-      JSG_REQUIRE(msg.serializedBody == nullptr, TypeError,
+      JSG_REQUIRE(msg.serializedBody == kj::none, TypeError,
           "Expected one of body or serializedBody for each message");
       jsg::Serializer serializer(js,
           jsg::Serializer::Options{
diff --git a/src/workerd/api/sockets.c++ b/src/workerd/api/sockets.c++
index 2270f505a40..1efe981da3f 100644
--- a/src/workerd/api/sockets.c++
+++ b/src/workerd/api/sockets.c++
@@ -343,7 +343,7 @@ jsg::Ref<Socket> Socket::startTls(jsg::Lock& js, jsg::Optional<TlsOptions> tlsOp
     // flush operation is taking a particularly long time (EW-8538), so we throw a JSG error if
     // that's the case.
     JSG_REQUIRE(
-        *tlsStarter != nullptr, TypeError, "The request has finished before startTls completed.");
+        *tlsStarter != kj::none, TypeError, "The request has finished before startTls completed.");
     auto secureStream = KJ_ASSERT_NONNULL(*tlsStarter)(acceptedHostname)
                             .then([stream = connectionStream->addWrappedRef()]() mutable
                                 -> kj::Own<kj::AsyncIoStream> { return kj::mv(stream); });
diff --git a/src/workerd/api/streams/standard.c++ b/src/workerd/api/streams/standard.c++
index 5ce0490860c..1589db0fca3 100644
--- a/src/workerd/api/streams/standard.c++
+++ b/src/workerd/api/streams/standard.c++
@@ -1278,8 +1278,8 @@ typename WritableImpl<Self>::WriteRequest WritableImpl<Self>::dequeueWriteReques
 
 template <typename Self>
 void WritableImpl<Self>::doClose(jsg::Lock& js) {
-  KJ_ASSERT(closeRequest == nullptr);
-  KJ_ASSERT(inFlightClose == nullptr);
+  KJ_ASSERT(closeRequest == kj::none);
+  KJ_ASSERT(inFlightClose == kj::none);
   KJ_ASSERT(inFlightWrite == kj::none);
   KJ_ASSERT(maybePendingAbort == kj::none);
   KJ_ASSERT(writeRequests.empty());
@@ -3855,9 +3855,9 @@ void TransformStreamDefaultController::init(jsg::Lock& js,
   // TODO(someday): The stream standard includes placeholders for supporting byte-oriented
   // TransformStreams but does not yet define them. For now, we are limiting our implementation
   // here to only support value-based transforms.
-  JSG_REQUIRE(transformer.readableType == nullptr, TypeError,
+  JSG_REQUIRE(transformer.readableType == kj::none, TypeError,
       "transformer.readableType must be undefined.");
-  JSG_REQUIRE(transformer.writableType == nullptr, TypeError,
+  JSG_REQUIRE(transformer.writableType == kj::none, TypeError,
       "transformer.writableType must be undefined.");
 
   KJ_IF_SOME(transform, transformer.transform) {
diff --git a/src/workerd/api/web-socket.c++ b/src/workerd/api/web-socket.c++
index 6f943be8163..065a1bed9f2 100644
--- a/src/workerd/api/web-socket.c++
+++ b/src/workerd/api/web-socket.c++
@@ -625,7 +625,7 @@ void WebSocket::close(jsg::Lock& js, jsg::Optional<int> code, jsg::Optional<kj::
   if (reason != kj::none) {
     // The default code of 1005 cannot have a reason, per the standard, so if a reason is specified
     // then there must be a code, too.
-    JSG_REQUIRE(code != nullptr, TypeError,
+    JSG_REQUIRE(code != kj::none, TypeError,
         "If you specify a WebSocket close reason, you must also specify a code.");
   }
 
diff --git a/src/workerd/io/worker.c++ b/src/workerd/io/worker.c++
index 37e746ac256..c9e7f752541 100644
--- a/src/workerd/io/worker.c++
+++ b/src/workerd/io/worker.c++
@@ -3593,7 +3593,7 @@ void Worker::Actor::assertCanSetAlarm() {
       return;
     }
     KJ_CASE_ONEOF(handler, api::ExportedHandler) {
-      JSG_REQUIRE(handler.alarm != nullptr, TypeError,
+      JSG_REQUIRE(handler.alarm != kj::none, TypeError,
           "Your Durable Object class must have an alarm() handler in order to call setAlarm()");
       return;
     }
diff --git a/src/workerd/util/sqlite.c++ b/src/workerd/util/sqlite.c++
index 5d45942bd6d..8e8f1f11647 100644
--- a/src/workerd/util/sqlite.c++
+++ b/src/workerd/util/sqlite.c++
@@ -891,8 +891,8 @@ bool SqliteDatabase::isAuthorized(int actionCode,
     case SQLITE_SELECT: /* NULL            NULL            */
       // Yes, SELECT statements are allowed. (Note that if the SELECT names any tables, a separate
       // SQLITE_READ will be authorized for each one.)
-      KJ_ASSERT(param1 == nullptr);
-      KJ_ASSERT(param2 == nullptr);
+      KJ_ASSERT(param1 == kj::none);
+      KJ_ASSERT(param2 == kj::none);
       return true;
 
     case SQLITE_CREATE_TABLE: /* Table Name      NULL            */
@@ -903,7 +903,7 @@ bool SqliteDatabase::isAuthorized(int actionCode,
     case SQLITE_CREATE_VIEW:  /* View Name       NULL            */
     case SQLITE_DROP_VIEW:    /* View Name       NULL            */
     case SQLITE_REINDEX:      /* Index Name      NULL            */
-      KJ_ASSERT(param2 == nullptr);
+      KJ_ASSERT(param2 == kj::none);
       return regulator.isAllowedName(KJ_ASSERT_NONNULL(param1));
 
     case SQLITE_ALTER_TABLE: /* Table Name      NULL (modified) */
@@ -941,7 +941,7 @@ bool SqliteDatabase::isAuthorized(int actionCode,
         ctx.stateChange = kj::mv(change);
       }
 
-      KJ_ASSERT(param2 == nullptr);
+      KJ_ASSERT(param2 == kj::none);
       return true;
     }