diff --git a/Cargo.toml b/Cargo.toml
index de2bcd9bc..26182ebca 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -172,6 +172,7 @@ suspicious = "deny"
 # Individual Lints
 assertions_on_result_states = "deny"
 manual_string_new = "deny"
+map_unwrap_or = "deny"
 semicolon_if_nothing_returned = "deny"
 undocumented_unsafe_blocks = "deny"
 uninlined_format_args = "deny"
diff --git a/devices/src/pvmemcontrol.rs b/devices/src/pvmemcontrol.rs
index d7fd7ff3b..06e0e2492 100644
--- a/devices/src/pvmemcontrol.rs
+++ b/devices/src/pvmemcontrol.rs
@@ -648,8 +648,10 @@ impl PvmemcontrolBusDevice {
                             .find_connection(conn)
                             .ok_or(Error::InvalidConnection(conn.command))
                     })
-                    .map(|gpa| self.handle_pvmemcontrol_request(gpa))
-                    .unwrap_or_else(|err| warn!("{err:?}"));
+                    .map_or_else(
+                        |err| warn!("{err:?}"),
+                        |gpa| self.handle_pvmemcontrol_request(gpa),
+                    );
             }
         }
     }
diff --git a/src/bin/ch-remote.rs b/src/bin/ch-remote.rs
index 13af148bd..8d89b607b 100644
--- a/src/bin/ch-remote.rs
+++ b/src/bin/ch-remote.rs
@@ -1161,7 +1161,7 @@ fn main() {
             if let Some(api_client::Error::ServerResponse(status_code, body)) =
                 error.downcast_ref::<api_client::Error>()
             {
-                let body = body.as_ref().map(|body| body.as_str()).unwrap_or("");
+                let body = body.as_ref().map_or("", |body| body.as_str());
 
                 // Retrieve the list of error messages back.
                 let lines: Vec<&str> = match serde_json::from_str(body) {
diff --git a/virtio-devices/src/block.rs b/virtio-devices/src/block.rs
index 37488a82a..93c07763e 100644
--- a/virtio-devices/src/block.rs
+++ b/virtio-devices/src/block.rs
@@ -735,9 +735,7 @@ impl Block {
                 (disk_nsectors, avail_features, 0, config, false)
             };
 
-        let serial = serial
-            .map(Vec::from)
-            .unwrap_or_else(|| build_serial(&disk_path));
+        let serial = serial.map_or_else(|| build_serial(&disk_path), Vec::from);
 
         Ok(Block {
             common: VirtioCommon {
@@ -773,21 +771,20 @@ impl Block {
     // TODO In future, we could add a `lock_granularity=` configuration to the CLI.
     // For now, we stick to QEMU behavior.
     fn lock_granularity(&mut self) -> LockGranularity {
-        let fallback = LockGranularity::WholeFile;
-
-        self.disk_image
-            .size()
-            .map(|size| LockGranularity::ByteRange(0, size))
+        self.disk_image.size().map_or_else(
             // use a safe fallback
-            .unwrap_or_else(|e| {
-                log::warn!(
+            |e| {
+                let fallback = LockGranularity::WholeFile;
+                warn!(
                     "Can't get disk size for id={},path={}, falling back to {:?}: error: {e}",
                     self.id,
                     self.disk_path.display(),
                     fallback
                 );
                 fallback
-            })
+            },
+            |size| LockGranularity::ByteRange(0, size),
+        )
     }
 
     /// Tries to set an advisory lock for the corresponding disk image.
diff --git a/vmm/src/config.rs b/vmm/src/config.rs
index 5c04e6083..292cd275a 100644
--- a/vmm/src/config.rs
+++ b/vmm/src/config.rs
@@ -1562,8 +1562,7 @@ impl BalloonConfig {
         let size = parser
             .convert::<ByteSized>("size")
             .map_err(Error::ParseBalloon)?
-            .map(|v| v.0)
-            .unwrap_or(0);
+            .map_or(0, |v| v.0);
 
         let deflate_on_oom = parser
             .convert::<Toggle>("deflate_on_oom")
@@ -2482,7 +2481,7 @@ impl VmConfig {
 
         #[cfg(feature = "tdx")]
         {
-            let tdx_enabled = self.platform.as_ref().map(|p| p.tdx).unwrap_or(false);
+            let tdx_enabled = self.platform.as_ref().is_some_and(|p| p.tdx);
             // At this point we know payload isn't None.
             if tdx_enabled && self.payload.as_ref().unwrap().firmware.is_none() {
                 return Err(ValidationError::TdxFirmwareMissing);
@@ -3110,12 +3109,12 @@ impl VmConfig {
 
     #[cfg(feature = "tdx")]
     pub fn is_tdx_enabled(&self) -> bool {
-        self.platform.as_ref().map(|p| p.tdx).unwrap_or(false)
+        self.platform.as_ref().is_some_and(|p| p.tdx)
     }
 
     #[cfg(feature = "sev_snp")]
     pub fn is_sev_snp_enabled(&self) -> bool {
-        self.platform.as_ref().map(|p| p.sev_snp).unwrap_or(false)
+        self.platform.as_ref().is_some_and(|p| p.sev_snp)
     }
 }
 
diff --git a/vmm/src/device_manager.rs b/vmm/src/device_manager.rs
index 1883e0d7b..727c5b504 100644
--- a/vmm/src/device_manager.rs
+++ b/vmm/src/device_manager.rs
@@ -2113,8 +2113,7 @@ impl DeviceManager {
             .debug_console
             .clone()
             .iobase
-            .map(|port| port as u64)
-            .unwrap_or(debug_console::DEFAULT_PORT);
+            .map_or(debug_console::DEFAULT_PORT, |port| port as u64);
 
         self.bus_devices
             .push(Arc::clone(&debug_console) as Arc<dyn BusDeviceSync>);
diff --git a/vmm/src/sigwinch_listener.rs b/vmm/src/sigwinch_listener.rs
index b50e93c98..970e82fcf 100644
--- a/vmm/src/sigwinch_listener.rs
+++ b/vmm/src/sigwinch_listener.rs
@@ -104,7 +104,7 @@ unsafe fn close_unused_fds(keep_fds: &mut [RawFd]) {
         // The next fd is the one at i, because the indexes in the
         // iterator are offset by one due to the initial 0.
         let next_keep_fd = keep_fds.get(i);
-        let last = next_keep_fd.map(|fd| fd - 1).unwrap_or(RawFd::MAX);
+        let last = next_keep_fd.map_or(RawFd::MAX, |fd| fd - 1);
 
         if first > last {
             continue;
diff --git a/vmm/src/vm.rs b/vmm/src/vm.rs
index fdaa77802..f42fe2406 100644
--- a/vmm/src/vm.rs
+++ b/vmm/src/vm.rs
@@ -763,8 +763,7 @@ impl Vm {
                 .unwrap()
                 .payload
                 .as_ref()
-                .map(|p| p.fw_cfg_config.is_some())
-                .unwrap_or(false);
+                .is_some_and(|p| p.fw_cfg_config.is_some());
             if fw_cfg_config {
                 device_manager
                     .lock()
@@ -2338,8 +2337,7 @@ impl Vm {
                 .unwrap()
                 .payload
                 .as_ref()
-                .map(|p| p.fw_cfg_config.is_some())
-                .unwrap_or(false);
+                .is_some_and(|p| p.fw_cfg_config.is_some());
             if fw_cfg_enabled {
                 let fw_cfg_config = self
                     .config