We have identified three areas where language support for operating system extensibility is important: performance, safety, and expressive power. First, an extension language should support pointer-safe casting to avoid unnecessary copying of data. Second, an extension language must allow a caller to isolate untrusted code. Finally, an extension language should provide a vocabulary for describing interfaces, modules, and procedures in a first-class fashion. We present specific examples of these needs, and describe the changes to Modula-3 that we have made for our work in the \spin\ operating system.