diff --git a/wgpu-core/src/instance.rs b/wgpu-core/src/instance.rs
index 02e4b51885..277dda2246 100644
--- a/wgpu-core/src/instance.rs
+++ b/wgpu-core/src/instance.rs
@@ -485,8 +485,11 @@ impl<G: GlobalIdentityHandlerFactory> Global<G> {
         id.0
     }
 
+    /// # Safety
+    ///
+    /// `layer` must be a valid pointer.
     #[cfg(feature = "metal")]
-    pub fn instance_create_surface_metal(
+    pub unsafe fn instance_create_surface_metal(
         &self,
         layer: *mut std::ffi::c_void,
         id_in: Input<G, SurfaceId>,
diff --git a/wgpu/src/backend/direct.rs b/wgpu/src/backend/direct.rs
index cf0c64d249..115594998f 100644
--- a/wgpu/src/backend/direct.rs
+++ b/wgpu/src/backend/direct.rs
@@ -195,7 +195,7 @@ impl Context {
         &self,
         layer: *mut std::ffi::c_void,
     ) -> Surface {
-        let id = self.0.instance_create_surface_metal(layer, ());
+        let id = unsafe { self.0.instance_create_surface_metal(layer, ()) };
         Surface {
             id,
             configured_device: Mutex::default(),