diff --git a/zion/lib/message_queue.cpp b/zion/lib/message_queue.cpp
index b2d4f4f..813c8f5 100644
--- a/zion/lib/message_queue.cpp
+++ b/zion/lib/message_queue.cpp
@@ -20,6 +20,7 @@ glcr::ErrorCode UnboundedMessageQueue::PushBack(
         gScheduler->CurrentProcess().ReleaseCapability(reply_cap);
   }
 
+  msg_struct->caps.Resize(caps.size());
   for (uint64_t i = 0; i < caps.size(); i++) {
     // FIXME: This would feel safer closer to the relevant syscall.
     // FIXME: Race conditions on get->check->release here. Would be better to
@@ -90,7 +91,7 @@ glcr::ErrorCode UnboundedMessageQueue::PopFront(uint64_t* num_bytes,
 
   *num_caps = next_msg->caps.size();
   for (uint64_t i = 0; i < *num_caps; i++) {
-    caps[i] = proc.AddExistingCapability(next_msg->caps.PopFront());
+    caps[i] = proc.AddExistingCapability(next_msg->caps[i]);
   }
   return glcr::OK;
 }
@@ -124,6 +125,7 @@ glcr::ErrorCode SingleMessageQueue::PushBack(
     return glcr::INTERNAL;
   }
 
+  message_.caps.Resize(caps.size());
   for (uint64_t i = 0; i < caps.size(); i++) {
     // FIXME: This would feel safer closer to the relevant syscall.
     auto cap = gScheduler->CurrentProcess().GetCapability(caps[i]);
@@ -187,7 +189,7 @@ glcr::ErrorCode SingleMessageQueue::PopFront(uint64_t* num_bytes, void* bytes,
   *num_caps = message_.caps.size();
   auto& proc = gScheduler->CurrentProcess();
   for (uint64_t i = 0; i < *num_caps; i++) {
-    caps[i] = proc.AddExistingCapability(message_.caps.PopFront());
+    caps[i] = proc.AddExistingCapability(message_.caps[i]);
   }
   has_read_ = true;
 
diff --git a/zion/lib/message_queue.h b/zion/lib/message_queue.h
index 051b2f3..8210861 100644
--- a/zion/lib/message_queue.h
+++ b/zion/lib/message_queue.h
@@ -4,6 +4,7 @@
 #include <glacier/container/array_view.h>
 #include <glacier/container/intrusive_list.h>
 #include <glacier/container/linked_list.h>
+#include <glacier/container/vector.h>
 #include <glacier/memory/ref_ptr.h>
 #include <glacier/memory/shared_ptr.h>
 #include <glacier/status/error.h>
@@ -15,7 +16,7 @@
 struct IpcMessage {
   glcr::Array<uint8_t> data;
 
-  glcr::LinkedList<glcr::RefPtr<Capability>> caps;
+  glcr::Vector<glcr::RefPtr<Capability>> caps;
 
   glcr::RefPtr<Capability> reply_cap;
 };