diff --git a/crates/typst-cli/src/world.rs b/crates/typst-cli/src/world.rs
index 12e80d273..2da03d4d5 100644
--- a/crates/typst-cli/src/world.rs
+++ b/crates/typst-cli/src/world.rs
@@ -210,7 +210,9 @@ impl World for SystemWorld {
     }
 
     fn font(&self, index: usize) -> Option<Font> {
-        self.fonts[index].get()
+        // comemo's validation may invoke this function with an invalid index. This is
+        // impossible in typst-cli but possible if a custom tool mutates the fonts.
+        self.fonts.get(index)?.get()
     }
 
     fn today(&self, offset: Option<i64>) -> Option<Datetime> {
diff --git a/crates/typst-ide/src/tests.rs b/crates/typst-ide/src/tests.rs
index 6678ab841..c6d733ca9 100644
--- a/crates/typst-ide/src/tests.rs
+++ b/crates/typst-ide/src/tests.rs
@@ -97,7 +97,7 @@ impl World for TestWorld {
     }
 
     fn font(&self, index: usize) -> Option<Font> {
-        Some(self.base.fonts[index].clone())
+        self.base.fonts.get(index).cloned()
     }
 
     fn today(&self, _: Option<i64>) -> Option<Datetime> {
diff --git a/docs/src/html.rs b/docs/src/html.rs
index 9077d5c47..9c02f08e9 100644
--- a/docs/src/html.rs
+++ b/docs/src/html.rs
@@ -498,7 +498,7 @@ impl World for DocWorld {
     }
 
     fn font(&self, index: usize) -> Option<Font> {
-        Some(FONTS.1[index].clone())
+        FONTS.1.get(index).cloned()
     }
 
     fn today(&self, _: Option<i64>) -> Option<Datetime> {
diff --git a/tests/src/world.rs b/tests/src/world.rs
index 9e0e91ad7..fe2bd45ea 100644
--- a/tests/src/world.rs
+++ b/tests/src/world.rs
@@ -67,7 +67,7 @@ impl World for TestWorld {
     }
 
     fn font(&self, index: usize) -> Option<Font> {
-        Some(self.base.fonts[index].clone())
+        self.base.fonts.get(index).cloned()
     }
 
     fn today(&self, _: Option<i64>) -> Option<Datetime> {