diff --git a/Cargo.toml b/Cargo.toml
index d919a05..b55d3ff 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -139,3 +139,7 @@ assets = [
 # Set Obsoletes per https://docs.fedoraproject.org/en-US/packaging-guidelines/#renaming-or-replacing-existing-packages.
 [package.metadata.generate-rpm.obsoletes]
 ldns-utils = "< 0:1.8.4-2"
+
+# To get the recordsiter_from_refs branch.
+[patch.'https://github.com/NLnetLabs/domain.git']
+domain = { path = "../domain" }
diff --git a/src/commands/keygen.rs b/src/commands/keygen.rs
index b3f6c73..daacc1b 100644
--- a/src/commands/keygen.rs
+++ b/src/commands/keygen.rs
@@ -330,7 +330,7 @@ impl Keygen {
         // TODO: Attempt repeated generation to avoid key tag collisions.
         // TODO: Add a high-level operation in 'domain' to select flags?
         let flags = if self.make_ksk { 257 } else { 256 };
-        let (secret_key, public_key) = domain::crypto::sign::generate(params, flags)
+        let (secret_key, public_key) = domain::crypto::sign::generate(&params, flags)
             .map_err(|err| format!("an implementation error occurred: {err}").into())
             .context("generating a cryptographic keypair")?;
         let digest = self.make_ksk.then(|| {
diff --git a/src/commands/keyset/cmd.rs b/src/commands/keyset/cmd.rs
index b1de361..f38393e 100644
--- a/src/commands/keyset/cmd.rs
+++ b/src/commands/keyset/cmd.rs
@@ -2612,8 +2612,9 @@ impl WorkSpace {
 
         // Otherwise use Ring/OpenSSL based key generation.
         let (secret_key, public_key, key_tag) = loop {
-            let (secret_key, public_key) = domain::crypto::sign::generate(algorithm.clone(), flags)
-                .map_err(|e| format!("key generation failed: {e}\n"))?;
+            let (secret_key, public_key) =
+                domain::crypto::sign::generate(&algorithm.clone(), flags)
+                    .map_err(|e| format!("key generation failed: {e}\n"))?;
 
             let key_tag = public_key.key_tag();
             if !keys.iter().any(|(_, k)| k.key_tag() == key_tag) {
@@ -2804,8 +2805,8 @@ impl WorkSpace {
                 KeyType::Include(_) => false,
             };
 
-            let rrset =
-                Rrset::new(&dnskeys).map_err(|e| format!("unable to create Rrset: {e}\n"))?;
+            let rrset = Rrset::new_from_owned(&dnskeys)
+                .map_err(|e| format!("unable to create Rrset: {e}\n"))?;
 
             if dnskey_signer {
                 let privref = v.privref().ok_or("missing private key")?;
@@ -2949,10 +2950,10 @@ impl WorkSpace {
                 KeyType::Include(_) => false,
             };
 
-            let cds_rrset =
-                Rrset::new(&cds_list).map_err(|e| format!("unable to create Rrset: {e}\n"))?;
-            let cdnskey_rrset =
-                Rrset::new(&cdnskey_list).map_err(|e| format!("unable to create Rrset: {e}\n"))?;
+            let cds_rrset = Rrset::new_from_owned(&cds_list)
+                .map_err(|e| format!("unable to create Rrset: {e}\n"))?;
+            let cdnskey_rrset = Rrset::new_from_owned(&cdnskey_list)
+                .map_err(|e| format!("unable to create Rrset: {e}\n"))?;
 
             if dnskey_signer {
                 let privref = v.privref().ok_or("missing private key")?;
diff --git a/src/commands/signzone.rs b/src/commands/signzone.rs
index d2dc18e..7a41e20 100644
--- a/src/commands/signzone.rs
+++ b/src/commands/signzone.rs
@@ -53,7 +53,9 @@ use domain::dnssec::sign::denial::nsec3::mk_hashed_nsec3_owner_name;
 use domain::dnssec::sign::denial::nsec3::{GenerateNsec3Config, Nsec3ParamTtlMode};
 use domain::dnssec::sign::error::SigningError;
 use domain::dnssec::sign::keys::SigningKey;
-use domain::dnssec::sign::records::{OwnerRrs, RecordsIter, Rrset, SortedRecords};
+use domain::dnssec::sign::records::{
+    OwnerRrs, RecordsIter, Rrset, SliceRefsOrOwned, SortedRecords,
+};
 use domain::dnssec::sign::signatures::rrsigs::sign_rrset;
 use domain::dnssec::sign::traits::{Signable, SignableZoneInPlace};
 use domain::dnssec::sign::SigningConfig;
@@ -841,10 +843,10 @@ impl SignZone {
             let mut dnskey_extra = Vec::new();
             let mut all_dnskeys = Vec::new();
             let empty_records: [Record<_, _>; 0] = [];
-            for r in dnskey_rrset
-                .as_ref()
-                .map_or(empty_records.iter(), |r| r.iter())
-            {
+            for r in dnskey_rrset.as_ref().map_or(
+                SliceRefsOrOwned::new_from_owned(&empty_records).iter(),
+                |r| r.iter(),
+            ) {
                 all_dnskeys.push(r.clone());
             }
             if !self.do_not_add_keys_to_zone {
@@ -857,7 +859,10 @@ impl SignZone {
                     let pubkey = k.dnskey();
                     if !dnskey_rrset
                         .as_ref()
-                        .map_or(empty_records.iter(), |r| r.iter())
+                        .map_or(
+                            SliceRefsOrOwned::new_from_owned(&empty_records).iter(),
+                            |r| r.iter(),
+                        )
                         .any(|k| {
                             if let ZoneRecordData::Dnskey(dnskey) = k.data() {
                                 *dnskey == pubkey
@@ -875,7 +880,7 @@ impl SignZone {
                 }
             }
 
-            let all_dnskeys = Rrset::new(&all_dnskeys);
+            let all_dnskeys = Rrset::new_from_owned(&all_dnskeys);
 
             let mut dnskey_rrsigs = Vec::new();
             if let Ok(all_dnskeys) = all_dnskeys {
@@ -1816,8 +1821,8 @@ impl SignZone {
         expiration: Timestamp,
     ) -> Result<(), SigningError> {
         if !zonemd_rrs.is_empty() {
-            let zonemd_rrset =
-                Rrset::new(zonemd_rrs).expect("zonemd_rrs is not empty so new should not fail");
+            let zonemd_rrset = Rrset::new_from_owned(zonemd_rrs)
+                .expect("zonemd_rrs is not empty so new should not fail");
             let mut new_rrsig_recs = zonemd_rrset.sign(apex, keys, inception, expiration)?;
             records.update_data(|rr| {
                 matches!(rr.data(), ZoneRecordData::Rrsig(rrsig) if rr.owner() == apex && rrsig.type_covered() == Rtype::ZONEMD)