diff --git a/include/pcmki/pcmki_verify.h b/include/pcmki/pcmki_verify.h
index cc0778f2a9..c72585b024 100644
--- a/include/pcmki/pcmki_verify.h
+++ b/include/pcmki/pcmki_verify.h
@@ -1,57 +1,58 @@
 /*
  * Copyright 2024 the Pacemaker project contributors
  *
  * The version control history for this file may have further details.
  *
  * This source code is licensed under the GNU Lesser General Public License
  * version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
  */
 
 #ifndef PCMK__PCMKI_PCMKI_VERIFY__H
 #define PCMK__PCMKI_PCMKI_VERIFY__H
 
 #include <crm/common/output_internal.h>
 #include <crm/common/scheduler.h>
 #include <libxml/tree.h>
 
 #ifdef __cplusplus
 extern "C" {
 #endif
 
 /*!
  * \internal
  * \brief Parse a CIB file
  *
  * This function parses a CIB file into a CIB object
  *
  * \param[in]     out          Output to use for logging and printing results
  * \param[in]     cib_source   Source of the CIB: 
  *                             NULL -> use live cib, "-" -> stdin
  *                             "<..." -> xml str, otherwise -> xml file name                    
  * \param[in,out] cib_object   The resulting, parsed CIB object
  *
  * \return Standard Pacemaker return code
  */
 int pcmk__parse_cib(pcmk__output_t *out, const char *cib_source, xmlNodePtr *cib_object);
 
 /*!
  * \internal
  * \brief Verify that a CIB is error-free or output errors and warnings
  *
  * This high-level function essentially implements crm_verify(8). It operates
  * on an input CIB file, which can be inputted through one of several ways. It
  * can either write out XML-formatted output or plaintext output.
  *
  * \param[in,out] scheduler    Scheduler data
  * \param[in]     out          Output to use for logging and printing results
- * \param[in]     cib_object   The parsed CIB object
+ * \param[in,out] cib_object   The parsed CIB object
  *
  * \return Standard Pacemaker return code
  */
-int pcmk__verify(pcmk_scheduler_t *scheduler, pcmk__output_t *out, xmlNode *cib_object);
+int pcmk__verify(pcmk_scheduler_t *scheduler, pcmk__output_t *out,
+                 xmlNode **cib_object);
 
 #ifdef __cplusplus
 }
 #endif
 
 #endif // PCMK__PCMKI_PCMKI_VERIFY__H
diff --git a/lib/pacemaker/pcmk_verify.c b/lib/pacemaker/pcmk_verify.c
index b95a86bf11..56c3b9b383 100644
--- a/lib/pacemaker/pcmk_verify.c
+++ b/lib/pacemaker/pcmk_verify.c
@@ -1,153 +1,156 @@
 /*
  * Copyright 2023-2024 the Pacemaker project contributors
  *
  * The version control history for this file may have further details.
  *
  * This source code is licensed under the GNU Lesser General Public License
  * version 2.1 or later (LGPLv2.1+) WITHOUT ANY WARRANTY.
  */
 
 #include <crm_internal.h>
 #include <crm/cib/internal.h>
 #include <crm/common/output.h>
 #include <crm/common/results.h>
 #include <crm/common/scheduler.h>
 #include <pacemaker-internal.h>
 #include <pacemaker.h>
 
 #include <stdint.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <unistd.h>
 
 #include "libpacemaker_private.h"
 
 int
 pcmk__parse_cib(pcmk__output_t *out, const char *cib_source, xmlNodePtr *cib_object)
 {
     // @COMPAT Take an enum for cib_source instead of trying to figure it out?
     const char *first = cib_source;
 
     if (cib_source == NULL) {
         crm_info("Reading XML from: live cluster");
         return cib__signon_query(out, NULL, cib_object);
     }
 
     while (isspace(*first)) {
         first++;
     }
 
     if (*first == '<') {
         *cib_object = pcmk__xml_parse(cib_source);
     } else {
         *cib_object = pcmk__xml_read(cib_source);
     }
 
     return (*cib_object == NULL)? ENODATA : pcmk_rc_ok;
 }
 
 int
-pcmk__verify(pcmk_scheduler_t *scheduler, pcmk__output_t *out, xmlNode *cib_object)
+pcmk__verify(pcmk_scheduler_t *scheduler, pcmk__output_t *out,
+             xmlNode **cib_object)
 {
     int rc = pcmk_rc_ok;
     xmlNode *status = NULL;
     xmlNode *cib_object_copy = NULL;
 
-    if (!pcmk__xe_is(cib_object, PCMK_XE_CIB)) {
+    CRM_ASSERT(cib_object != NULL);
+
+    if (!pcmk__xe_is(*cib_object, PCMK_XE_CIB)) {
         rc = EBADMSG;
         out->err(out, "This tool can only check complete configurations (i.e. those starting with <cib>).");
         goto verify_done;
     }
 
-    status = pcmk_find_cib_element(cib_object, PCMK_XE_STATUS);
+    status = pcmk_find_cib_element(*cib_object, PCMK_XE_STATUS);
     if (status == NULL) {
-        pcmk__xe_create(cib_object, PCMK_XE_STATUS);
+        pcmk__xe_create(*cib_object, PCMK_XE_STATUS);
     }
 
-    if (!pcmk__validate_xml(cib_object, NULL,
+    if (!pcmk__validate_xml(*cib_object, NULL,
                             (xmlRelaxNGValidityErrorFunc) out->err, out)) {
         crm_config_error = TRUE;
         rc = pcmk_rc_schema_validation;
         goto verify_done;
     }
 
-    rc = pcmk_update_configured_schema(&cib_object, false);
+    rc = pcmk_update_configured_schema(cib_object, false);
     if (rc != pcmk_rc_ok) {
         crm_config_error = TRUE;
         out->err(out, "The cluster will NOT be able to use this configuration.\n"
                  "Please manually update the configuration to conform to the %s syntax.",
                  pcmk__highest_schema_name());
         goto verify_done;
     }
 
     /* Process the configuration to set crm_config_error/crm_config_warning.
      *
      * @TODO Some parts of the configuration are unpacked only when needed (for
      * example, action configuration), so we aren't necessarily checking those.
      */
-    if (cib_object != NULL) {
+    if (*cib_object != NULL) {
         unsigned long long flags = pcmk__sched_no_counts|pcmk__sched_no_compat;
 
         if (status == NULL) {
             // No status available, so do minimal checks
             flags |= pcmk__sched_validate_only;
         }
-        cib_object_copy = pcmk__xml_copy(NULL, cib_object);
+        cib_object_copy = pcmk__xml_copy(NULL, *cib_object);
 
         /* The scheduler takes ownership of the XML object and potentially
          * frees it later. We want the caller of pcmk__verify to retain
          * ownership of the passed-in XML object, hence we pass in a copy
          * to the scheduler.
          */ 
         pcmk__schedule_actions(cib_object_copy, flags, scheduler);
     }
 
 verify_done:
     if (crm_config_error) {
         rc = pcmk_rc_schema_validation;
         pcmk__config_err("CIB did not pass schema validation");
     } else if (crm_config_warning) {
         rc = pcmk_rc_schema_validation;
     }
     return rc;
 }
 
 int
 pcmk_verify(xmlNodePtr *xml, const char *cib_source)
 {
     pcmk_scheduler_t *scheduler = NULL;
     pcmk__output_t *out = NULL;
     int rc = pcmk_rc_ok;
 
     xmlNode *cib_object = NULL;
 
     rc = pcmk__xml_output_new(&out, xml);
     if (rc != pcmk_rc_ok) {
         return rc;
     }
 
     pe__register_messages(out);
     pcmk__register_lib_messages(out);
 
     rc = pcmk__parse_cib(out, cib_source, &cib_object);
     if (rc != pcmk_rc_ok) {
         out->err(out, "Couldn't parse input");
         goto done;
     }
 
     scheduler = pe_new_working_set();
     if (scheduler == NULL) {
         rc = errno;
         out->err(out, "Couldn't allocate scheduler data: %s", pcmk_rc_str(rc));
         goto done;
     }
 
     scheduler->priv->out = out;
-    rc = pcmk__verify(scheduler, out, cib_object);
+    rc = pcmk__verify(scheduler, out, &cib_object);
 
 done:
     pe_free_working_set(scheduler);
     pcmk__xml_output_finish(out, pcmk_rc2exitc(rc), xml);
     pcmk__xml_free(cib_object);
     return rc;
 }
diff --git a/tools/crm_verify.c b/tools/crm_verify.c
index 66a0afb79e..ebfcd2ac63 100644
--- a/tools/crm_verify.c
+++ b/tools/crm_verify.c
@@ -1,306 +1,306 @@
 /*
  * Copyright 2004-2024 the Pacemaker project contributors
  *
  * The version control history for this file may have further details.
  *
  * This source code is licensed under the GNU General Public License version 2
  * or later (GPLv2+) WITHOUT ANY WARRANTY.
  */
 
 #include <crm_internal.h>
 #include <crm/crm.h>
 #include <crm/common/cmdline_internal.h>
 #include <crm/common/output_internal.h>
 
 #include <stdio.h>
 #include <sys/types.h>
 #include <unistd.h>
 
 #include <stdlib.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <libgen.h>
 #include <glib.h>
 
 #include <crm/common/xml.h>
 #include <crm/common/util.h>
 #include <crm/cib.h>
 #include <crm/cib/internal.h>
 #include <crm/pengine/status.h>
 #include <pacemaker-internal.h>
 
 const char *SUMMARY = "Check a Pacemaker configuration for errors\n\n"
                       "Check the well-formedness of a complete Pacemaker XML configuration,\n"
                       "its conformance to the configured schema, and the presence of common\n"
                       "misconfigurations. Problems reported as errors must be fixed before the\n"
                       "cluster will work properly. It is left to the administrator to decide\n"
                       "whether to fix problems reported as warnings.";
 
 struct {
     char *cib_save;
     gboolean use_live_cib;
     char *xml_file;
     gboolean xml_stdin;
     char *xml_string;
     unsigned int verbosity;
 } options;
 
 static GOptionEntry data_entries[] = {
     { "live-check", 'L', 0, G_OPTION_ARG_NONE,
       &options.use_live_cib, "Check the configuration used by the running cluster",
       NULL },
     { "xml-file", 'x', 0, G_OPTION_ARG_FILENAME,
       &options.xml_file, "Check the configuration in the named file",
       "FILE" },
     { "xml-pipe", 'p', 0, G_OPTION_ARG_NONE,
       &options.xml_stdin, "Check the configuration piped in via stdin",
       NULL },
     { "xml-text", 'X', 0, G_OPTION_ARG_STRING,
       &options.xml_string, "Check the configuration in the supplied string",
       "XML" },
 
     { NULL }
 };
 
 static GOptionEntry addl_entries[] = {
     { "save-xml", 'S', G_OPTION_FLAG_NONE, G_OPTION_ARG_FILENAME,
       &options.cib_save, "Save verified XML to named file (most useful with -L)",
       "FILE" },
 
     { NULL }
 };
 
 static pcmk__supported_format_t formats[] = {
     PCMK__SUPPORTED_FORMAT_NONE,
     PCMK__SUPPORTED_FORMAT_TEXT,
     PCMK__SUPPORTED_FORMAT_XML,
     { NULL, NULL, NULL }
 };
 
 static GOptionContext *
 build_arg_context(pcmk__common_args_t *args, GOptionGroup **group) {
     GOptionContext *context = NULL;
 
     const char *description = "Examples:\n\n"
                               "Check the consistency of the configuration in the running cluster:\n\n"
                               "\tcrm_verify --live-check\n\n"
                               "Check the consistency of the configuration in a given file and "
                               "produce quiet output:\n\n"
                               "\tcrm_verify --xml-file file.xml --quiet\n\n"
                               "Check the consistency of the configuration in a given file and "
                               "produce verbose output:\n\n"
                               "\tcrm_verify --xml-file file.xml --verbose\n\n";
 
     GOptionEntry extra_prog_entries[] = {
         { "quiet", 'q', 0, G_OPTION_ARG_NONE, &(args->quiet),
           "Don't print verify information",
           NULL },
         { NULL }
     };
 
     context = pcmk__build_arg_context(args, "text (default), xml", group, NULL);
 
     pcmk__add_main_args(context, extra_prog_entries);
 
     g_option_context_set_description(context, description);
 
     pcmk__add_arg_group(context, "data", "Data sources:",
                         "Show data options", data_entries);
     pcmk__add_arg_group(context, "additional", "Additional options:",
                         "Show additional options", addl_entries);
 
     return context;
 }
 
 /*!
  * \internal
  * \brief Output a configuration error
  *
  * \param[in] ctx  Output object
  * \param[in] msg  printf(3)-style format string
  * \param[in] ...  Format string arguments
  */
 G_GNUC_PRINTF(2, 3)
 static void
 output_config_error(void *ctx, const char *msg, ...)
 {
     va_list ap;
     char *buf = NULL;
     pcmk__output_t *out = ctx;
 
     va_start(ap, msg);
     CRM_ASSERT(vasprintf(&buf, msg, ap) > 0);
     if (options.verbosity > 0) {
         out->err(out, "error: %s", buf);
     }
     va_end(ap);
 }
 
 /*!
  * \internal
  * \brief Output a configuration warning
  *
  * \param[in] ctx  Output object
  * \param[in] msg  printf(3)-style format string
  * \param[in] ...  Format string arguments
  */
 G_GNUC_PRINTF(2, 3)
 static void
 output_config_warning(void *ctx, const char *msg, ...)
 {
     va_list ap;
     char *buf = NULL;
     pcmk__output_t *out = ctx;
 
     va_start(ap, msg);
     CRM_ASSERT(vasprintf(&buf, msg, ap) > 0);
     if (options.verbosity > 0) {
         out->err(out, "warning: %s", buf);
     }
     va_end(ap);
 }
 
 int
 main(int argc, char **argv)
 {
 
     pcmk_scheduler_t *scheduler = NULL;
 
     int rc = pcmk_rc_ok;
     crm_exit_t exit_code = CRM_EX_OK;
 
     GError *error = NULL;
 
     pcmk__output_t *out = NULL;
 
     const char *cib_source = NULL;
     xmlNode *cib_object = NULL;
 
     GOptionGroup *output_group = NULL;
 
     const char *failure_type = NULL;
 
     pcmk__common_args_t *args = pcmk__new_common_args(SUMMARY);
     gchar **processed_args = pcmk__cmdline_preproc(argv, "xSX");
     GOptionContext *context = build_arg_context(args, &output_group);
 
     pcmk__register_formats(output_group, formats);
     if (!g_option_context_parse_strv(context, &processed_args, &error)) {
         exit_code = CRM_EX_USAGE;
         goto done;
     }
 
     if (args->verbosity > 0) {
         args->verbosity -= args->quiet;
     }
 
     pcmk__cli_init_logging("crm_verify", args->verbosity);
 
     rc = pcmk__output_new(&out, args->output_ty, args->output_dest, argv);
     if (rc != pcmk_rc_ok) {
         exit_code = CRM_EX_ERROR;
         g_set_error(&error, PCMK__EXITC_ERROR, exit_code, "Error creating output format %s: %s",
                     args->output_ty, pcmk_rc_str(rc));
         goto done;
     }
 
     if (args->version) {
         out->version(out, false);
         goto done;
     }
 
     pcmk__register_lib_messages(out);
 
     pcmk__set_config_error_handler(output_config_error, out);
     pcmk__set_config_warning_handler(output_config_warning, out);
 
     if (pcmk__str_eq(args->output_ty, "xml", pcmk__str_none)) {
         args->verbosity = 1;
     }
     options.verbosity = args->verbosity;
 
     if (options.xml_file != NULL) {
         cib_source = options.xml_file;
     } else if (options.xml_string != NULL) {
         cib_source = options.xml_string;
     } else if (options.xml_stdin) {
         cib_source = "-";
     } else if (options.use_live_cib) {
         cib_source = NULL;
     } else {
         rc = ENODATA;
         g_set_error(&error, PCMK__EXITC_ERROR, exit_code, "No input specified");
         goto done;
     }
 
     rc = pcmk__parse_cib(out, cib_source, &cib_object);
 
     if (rc != pcmk_rc_ok) {
         g_set_error(&error, PCMK__EXITC_ERROR, rc, "Couldn't parse input");
         goto done;
     }
 
     if (options.cib_save != NULL) {
         pcmk__xml_write_file(cib_object, options.cib_save, false);
     }
 
     scheduler = pe_new_working_set();
 
     if (scheduler == NULL) {
         rc = errno;
         g_set_error(&error, PCMK__RC_ERROR, rc,
                     "Could not allocate scheduler data: %s", pcmk_rc_str(rc));
         goto done;
     }
 
     scheduler->priv->out = out;
 
-    rc = pcmk__verify(scheduler, out, cib_object);
+    rc = pcmk__verify(scheduler, out, &cib_object);
 
     if (rc == pcmk_rc_schema_validation) {
         if (crm_config_error) {
             failure_type = "Errors found during check: ";
           } else if (crm_config_warning) {
             failure_type = "Warnings found during check: ";
           } else {
             failure_type = "";
           }
 
           if (args->quiet) {
               // User requested no output
 
           } else if (options.verbosity > 0) {
               out->err(out, "%sconfig not valid", failure_type);
 
           } else {
               out->err(out, "%sconfig not valid\n-V may provide more details", failure_type);
           }
         }
 
     pe_free_working_set(scheduler);
 
   done:
     g_strfreev(processed_args);
     pcmk__free_arg_context(context);
     free(options.cib_save);
     free(options.xml_file);
     free(options.xml_string);
 
     if (cib_object != NULL) {
         pcmk__xml_free(cib_object);
     }
 
     if (exit_code == CRM_EX_OK) {
         exit_code = pcmk_rc2exitc(rc);
     }
 
     pcmk__output_and_clear_error(&error, out);
 
     if (out != NULL) {
         out->finish(out, exit_code, true, NULL);
         pcmk__output_free(out);
     }
 
     pcmk__unregister_formats();
     crm_exit(exit_code);
 }