diff --git a/composer.json b/composer.json
index f8384231a..93a07e21e 100644
--- a/composer.json
+++ b/composer.json
@@ -142,7 +142,7 @@
         "mockery/mockery": "^1.6.12",
         "phpunit/phpunit": "^10.5.41",
         "ramsey/collection": "^1.3",
-        "rector/rector": "~2.5.8",
+        "rector/rector": "~2.6.1",
         "spiral/code-style": "^2.2.2",
         "spiral/nyholm-bridge": "^1.3",
         "spiral/testing": "^2.12",
diff --git a/src/Security/tests/PermissionManagerTest.php b/src/Security/tests/PermissionManagerTest.php
index 65b4c4bac..246055136 100644
--- a/src/Security/tests/PermissionManagerTest.php
+++ b/src/Security/tests/PermissionManagerTest.php
@@ -70,7 +70,7 @@ public function testAssociation(): void
 
         $this->rules->method('has')->willReturn(true);
         $this->rules->method('get')
-            ->willReturnCallback(static function (...$args) use (&$series) {
+            ->willReturnCallback(static function (...$args) use (&$series): ForbidRule|AllowRule {
                 [$expectedArgs, $return] = \array_shift($series);
                 self::assertSame($expectedArgs, $args);
 
diff --git a/src/Tokenizer/src/Config/TokenizerConfig.php b/src/Tokenizer/src/Config/TokenizerConfig.php
index 5292c4c06..3b1576424 100644
--- a/src/Tokenizer/src/Config/TokenizerConfig.php
+++ b/src/Tokenizer/src/Config/TokenizerConfig.php
@@ -22,7 +22,7 @@ final class TokenizerConfig extends InjectableConfig
 
     /**
      * @var array{
-     *     cache: array{directory: null, enabled: bool},
+     *     cache: array{directory: string|null, enabled: bool},
      *     load: array{classes:bool, enums: bool, interfaces: bool},
      *     debug: bool,
      *     directories: TDirectories,