diff --git a/sledge/TODO.org b/sledge/TODO.org
index 5db95e2d0..bf2773f1e 100644
--- a/sledge/TODO.org
+++ b/sledge/TODO.org
@@ -177,6 +177,7 @@ separation between xlate_intrinsic (which translates an intrinsic function name
 - inline asm can take addresses of blocks as args, that can be jumped to
 - treating inline asm conservatively requires considering these control flows
 ** support missing intrinsics
+** Try to extract scope for `ConstantExpr` and `ConstantPointerNull` value types
 ** support vector operations
 - by lowering into multiple scalar operations
 - most cases handled by Frontend.transform
diff --git a/sledge/src/llair/frontend.ml b/sledge/src/llair/frontend.ml
index 1547b248c..6e237d51f 100644
--- a/sledge/src/llair/frontend.ml
+++ b/sledge/src/llair/frontend.ml
@@ -81,8 +81,11 @@ let ( (scan_names_and_locs : Llvm.llmodule -> unit)
           Some (`Fun (Llvm.block_parent (Llvm.instr_parent llv)))
       | GlobalVariable | Function -> Some (`Mod (Llvm.global_parent llv))
       | UndefValue -> None
+      | ConstantExpr -> None
+      | ConstantPointerNull -> None
       | _ ->
-          warn "Unexpected type of llv, might crash: %a" pp_llvalue llv () ;
+          warn "Unexpected type %a of llv, might crash: %a" pp_llvaluekind
+            (Llvm.classify_value llv) pp_llvalue llv () ;
           Some (`Mod (Llvm.global_parent llv))
     in
     match maybe_scope with
diff --git a/sledge/src/sledge_buck.ml b/sledge/src/sledge_buck.ml
index 625dec6c8..f7780ec58 100644
--- a/sledge/src/sledge_buck.ml
+++ b/sledge/src/sledge_buck.ml
@@ -159,7 +159,14 @@ let llvm_link_opt ~fuzzer ~bitcode_output modules =
          (Lazy.force llvm_bin ^ "opt")
          [ "-o=" ^ bitcode_output; "-globaldce"; "-globalopt"; "-mergefunc"
          ; "-constmerge"; "-argpromotion"; "-ipsccp"; "-mem2reg"; "-dce"
-         ; "-globaldce"; "-deadargelim" ] )
+         ; "-globaldce"; "-deadargelim"; "-global-merge-on-const"
+         ; "-global-merge-ignore-single-use=false"
+         ; "-global-merge-group-by-use=false"
+           (* global-merge-max-offset is set to 0 by default. If a global
+              variable has larger allocation size than the max-offset, it is
+              not merged, therefore the global-merge pass is a noop. We set
+              it to something big, so that it merges as much as possible. *)
+         ; "-global-merge-max-offset=1000000"; "-global-merge" ] )
 
 (** command line interface *)