diff --git a/composer.json b/composer.json
index 8ec80a3..e22b6da 100644
--- a/composer.json
+++ b/composer.json
@@ -24,13 +24,13 @@
     "require-dev": {
         "nette/tester": "2.5.4",
         "mockery/mockery": "1.6.12",
-        "phpstan/phpstan": "1.12.7",
-        "phpstan/phpstan-strict-rules": "1.6.1",
-        "phpstan/phpstan-nette": "1.3.8",
-        "phpstan/phpstan-mockery": "1.1.3",
-        "nepada/phpstan-nette-tester": "1.2.1",
-        "spaze/phpstan-disallowed-calls": "4.0.1",
-        "shipmonk/phpstan-rules": "3.2.1",
+        "phpstan/phpstan": "2.1.1",
+        "phpstan/phpstan-strict-rules": "2.0.1",
+        "phpstan/phpstan-nette": "2.0.2",
+        "phpstan/phpstan-mockery": "2.0.0",
+        "nepada/phpstan-nette-tester": "2.0.0",
+        "spaze/phpstan-disallowed-calls": "4.1.1",
+        "shipmonk/phpstan-rules": "4.1.0",
         "php-parallel-lint/php-parallel-lint": "1.4.0",
         "nepada/coding-standard": "7.14.1",
         "nette/di": "^3.0.6@dev",
diff --git a/phpstan.neon.dist b/phpstan.neon.dist
index 4aaae99..a681f67 100644
--- a/phpstan.neon.dist
+++ b/phpstan.neon.dist
@@ -39,3 +39,33 @@ parameters:
             message: "#^Overwriting variable \\$resource while changing its type from Nette\\\\Security\\\\Resource to string$#"
             count: 1
             path: src/SecurityAnnotations/AccessValidators/PermissionValidator.php
+        - # pre-validated config
+            message: '#^Argument of an invalid type mixed supplied for foreach, only iterables are supported\.$#'
+            identifier: foreach.nonIterable
+            count: 1
+            path: src/Bridges/SecurityAnnotationsDI/SecurityAnnotationsExtension.php
+        - # pre-validated config
+            message: '#^Parameter \#1 \$validator of method Nepada\\Bridges\\SecurityAnnotationsDI\\SecurityAnnotationsExtension\:\:getValidatorService\(\) expects string, mixed given\.$#'
+            identifier: argument.type
+            count: 1
+            path: src/Bridges/SecurityAnnotationsDI/SecurityAnnotationsExtension.php
+        - # pre-validated config
+            message: '#^Parameter \#2 \.\.\.\$arrays of function array_merge expects array, mixed given\.$#'
+            identifier: argument.type
+            count: 1
+            path: src/Bridges/SecurityAnnotationsDI/SecurityAnnotationsExtension.php
+        -
+            message: '#^Parameter \#1 \$callback of function array_map expects \(callable\(mixed\)\: mixed\)\|null, Closure\(Nette\\Security\\Role\|string\)\: string given\.$#'
+            identifier: argument.type
+            count: 1
+            path: src/SecurityAnnotations/AccessValidators/RoleValidator.php
+        - # covered by tests
+            message: '#^Trait Nepada\\SecurityAnnotations\\SecuredComponents is used zero times and is not analysed\.$#'
+            identifier: trait.unused
+            count: 1
+            path: src/SecurityAnnotations/SecuredComponents.php
+        - # covered by tests
+            message: '#^Trait Nepada\\SecurityAnnotations\\SecurityAnnotations is used zero times and is not analysed\.$#'
+            identifier: trait.unused
+            count: 1
+            path: src/SecurityAnnotations/SecurityAnnotations.php
diff --git a/src/SecurityAnnotations/AnnotationReaders/AnnotationsReader.php b/src/SecurityAnnotations/AnnotationReaders/AnnotationsReader.php
index 0c6110f..7e31fff 100644
--- a/src/SecurityAnnotations/AnnotationReaders/AnnotationsReader.php
+++ b/src/SecurityAnnotations/AnnotationReaders/AnnotationsReader.php
@@ -7,7 +7,7 @@ interface AnnotationsReader
 {
 
     /**
-     * @return object[]
+     * @return list<object>
      */
     public function getAll(\Reflector $element): array;
 
diff --git a/src/SecurityAnnotations/AnnotationReaders/AttributesReader.php b/src/SecurityAnnotations/AnnotationReaders/AttributesReader.php
index c891ebb..2a3e755 100644
--- a/src/SecurityAnnotations/AnnotationReaders/AttributesReader.php
+++ b/src/SecurityAnnotations/AnnotationReaders/AttributesReader.php
@@ -11,7 +11,7 @@ final class AttributesReader implements AnnotationsReader
     use Nette\SmartObject;
 
     /**
-     * @return object[]
+     * @return list<object>
      */
     public function getAll(\Reflector $element): array
     {
diff --git a/src/SecurityAnnotations/AnnotationReaders/UnionReader.php b/src/SecurityAnnotations/AnnotationReaders/UnionReader.php
index 2ddcf7b..35362a3 100644
--- a/src/SecurityAnnotations/AnnotationReaders/UnionReader.php
+++ b/src/SecurityAnnotations/AnnotationReaders/UnionReader.php
@@ -11,23 +11,23 @@ final class UnionReader implements AnnotationsReader
     use Nette\SmartObject;
 
     /**
-     * @var AnnotationsReader[]
+     * @var list<AnnotationsReader>
      */
     private array $readers;
 
     public function __construct(AnnotationsReader ...$readers)
     {
-        $this->readers = $readers;
+        $this->readers = array_values($readers);
     }
 
     /**
-     * @return object[]
+     * @return list<object>
      */
     public function getAll(\Reflector $element): array
     {
         $annotations = [];
         foreach ($this->readers as $reader) {
-            $annotations = array_merge($annotations, array_values($reader->getAll($element)));
+            $annotations = array_merge($annotations, $reader->getAll($element));
         }
         return $annotations;
     }
diff --git a/tests/SecurityAnnotations/AccessValidators/PermissionValidatorTest.phpt b/tests/SecurityAnnotations/AccessValidators/PermissionValidatorTest.phpt
index c550a29..fad3d72 100644
--- a/tests/SecurityAnnotations/AccessValidators/PermissionValidatorTest.phpt
+++ b/tests/SecurityAnnotations/AccessValidators/PermissionValidatorTest.phpt
@@ -37,7 +37,7 @@ class PermissionValidatorTest extends TestCase
     }
 
     /**
-     * @return mixed[]
+     * @return list<mixed[]>
      */
     protected function getDataForAccessAllowed(): array
     {
@@ -79,7 +79,7 @@ class PermissionValidatorTest extends TestCase
     }
 
     /**
-     * @return mixed[]
+     * @return list<mixed[]>
      */
     protected function getDataForAccessDenied(): array
     {
diff --git a/tests/SecurityAnnotations/AccessValidators/RoleValidatorTest.phpt b/tests/SecurityAnnotations/AccessValidators/RoleValidatorTest.phpt
index d53372e..33c45cc 100644
--- a/tests/SecurityAnnotations/AccessValidators/RoleValidatorTest.phpt
+++ b/tests/SecurityAnnotations/AccessValidators/RoleValidatorTest.phpt
@@ -39,7 +39,7 @@ class RoleValidatorTest extends TestCase
     }
 
     /**
-     * @return mixed[]
+     * @return list<mixed[]>
      */
     protected function getDataForAccessAllowed(): array
     {
@@ -79,7 +79,7 @@ class RoleValidatorTest extends TestCase
     }
 
     /**
-     * @return mixed[]
+     * @return list<mixed[]>
      */
     protected function getDataForAccessDenied(): array
     {
diff --git a/tests/SecurityAnnotations/AnnotationReaders/DummyAnnotationReader.php b/tests/SecurityAnnotations/AnnotationReaders/DummyAnnotationReader.php
index c4e4fc8..3434788 100644
--- a/tests/SecurityAnnotations/AnnotationReaders/DummyAnnotationReader.php
+++ b/tests/SecurityAnnotations/AnnotationReaders/DummyAnnotationReader.php
@@ -9,12 +9,12 @@ final class DummyAnnotationReader implements AnnotationsReader
 {
 
     /**
-     * @var object[]
+     * @var list<object>
      */
     private array $annotations;
 
     /**
-     * @param object[] $annotations
+     * @param list<object> $annotations
      */
     public function __construct(array $annotations)
     {
@@ -22,7 +22,7 @@ public function __construct(array $annotations)
     }
 
     /**
-     * @return object[]
+     * @return list<object>
      */
     public function getAll(\Reflector $element): array
     {