diff --git a/rust/kernel/drm/kms/encoder.rs b/rust/kernel/drm/kms/encoder.rs
index 0c4577fde7f5d5a566782e391241725a9697c171..a6d8681959539f5efccdf1d5e93def105101d8ce 100644
--- a/rust/kernel/drm/kms/encoder.rs
+++ b/rust/kernel/drm/kms/encoder.rs
@@ -294,7 +294,11 @@ unsafe impl<T: KmsDriver> ModeObject for OpaqueEncoder<T> {
 // SAFETY: Encoders do not have a refcount
 unsafe impl<T: KmsDriver> StaticModeObject for OpaqueEncoder<T> {}
 
-impl<T: KmsDriver> AsRawEncoder for OpaqueEncoder<T> {
+// SAFETY:
+// * Via our type variants our data layout is identical to  with `drm_encoder`
+// * Since we don't expose `Encoder` to users before it has been initialized, this and our data
+//   layout ensure that `as_raw()` always returns a valid pointer to a `drm_encoder`.
+unsafe impl<T: KmsDriver> AsRawEncoder for OpaqueEncoder<T> {
     fn as_raw(&self) -> *mut bindings::drm_encoder {
         self.encoder.get()
     }