diff --git a/src/snmalloc/aal/aal.h b/src/snmalloc/aal/aal.h
index f56d89e..1038375 100644
--- a/src/snmalloc/aal/aal.h
+++ b/src/snmalloc/aal/aal.h
@@ -216,6 +216,19 @@ namespace snmalloc
         a.template as_static<T>().unsafe_ptr());
     }
 
+    template<
+      typename T,
+      SNMALLOC_CONCEPT(capptr::IsBound) BOut,
+      SNMALLOC_CONCEPT(capptr::IsBound) BIn,
+      typename U = T>
+    static SNMALLOC_FAST_PATH CapPtr<T, BOut>
+    capptr_rebound(CapPtr<T, BOut> a, CapPtr<U, BIn> b) noexcept
+    {
+      UNUSED(a);
+      return CapPtr<T, BOut>::unsafe_from(
+        b.template as_static<T>().unsafe_ptr());
+    }
+
     static SNMALLOC_FAST_PATH size_t capptr_size_round(size_t sz) noexcept
     {
       return sz;
diff --git a/src/snmalloc/aal/aal_cheri.h b/src/snmalloc/aal/aal_cheri.h
index b05bb5f..4a4acd3 100644
--- a/src/snmalloc/aal/aal_cheri.h
+++ b/src/snmalloc/aal/aal_cheri.h
@@ -93,6 +93,18 @@ namespace snmalloc
       return CapPtr<T, BOut>::unsafe_from(static_cast<T*>(pb));
     }
 
+    template<
+      typename T,
+      SNMALLOC_CONCEPT(capptr::IsBound) BOut,
+      SNMALLOC_CONCEPT(capptr::IsBound) BIn,
+      typename U = T>
+    static SNMALLOC_FAST_PATH CapPtr<T, BOut>
+    capptr_rebound(CapPtr<T, BOut> a, CapPtr<U, BIn> b) noexcept
+    {
+      return CapPtr<T, BOut>::unsafe_from(static_cast<T*>(
+        __builtin_cheri_address_set(a.unsafe_ptr(), address_cast(b))));
+    }
+
     static SNMALLOC_FAST_PATH size_t capptr_size_round(size_t sz) noexcept
     {
       /*
diff --git a/src/snmalloc/aal/aal_concept.h b/src/snmalloc/aal/aal_concept.h
index febd65b..3ce64a7 100644
--- a/src/snmalloc/aal/aal_concept.h
+++ b/src/snmalloc/aal/aal_concept.h
@@ -60,6 +60,15 @@ namespace snmalloc
     }
     noexcept->ConceptSame<capptr::Chunk<void>>;
 
+    /**
+     * "Amplify" by copying the address of one pointer into one of higher
+     * privilege.  The resulting pointer differs from auth only in address.
+     */
+    {
+      AAL::capptr_rebound(auth, ret)
+    }
+    noexcept->ConceptSame<capptr::Chunk<void>>;
+
     /**
      * Round up an allocation size to a size this architecture can represent.
      * While there may also, in general, be alignment requirements for