diff --git a/includes/Permissions/GroupPermissionsLookup.php b/includes/Permissions/GroupPermissionsLookup.php
index 52db33191fe..3bffd7016f2 100644
--- a/includes/Permissions/GroupPermissionsLookup.php
+++ b/includes/Permissions/GroupPermissionsLookup.php
@@ -39,10 +39,10 @@ class GroupPermissionsLookup {
 		'RevokePermissions',
 	];
 
-	/** @var array */
+	/** @var array[] */
 	private $groupPermissions;
 
-	/** @var array */
+	/** @var array[] */
 	private $revokePermissions;
 
 	/** @var string[] */
diff --git a/includes/Permissions/PermissionManager.php b/includes/Permissions/PermissionManager.php
index b47aa7f0afd..e67fd0fea91 100644
--- a/includes/Permissions/PermissionManager.php
+++ b/includes/Permissions/PermissionManager.php
@@ -1634,7 +1634,7 @@ class PermissionManager {
 	 *
 	 * @param int $index Namespace ID (index) to check
 	 * @param UserIdentity|null $user User to check
-	 * @return array
+	 * @return string[]
 	 */
 	public function getNamespaceRestrictionLevels( $index, UserIdentity $user = null ) {
 		if ( !isset( $this->options->get( 'NamespaceProtection' )[$index] ) ) {
diff --git a/includes/Permissions/RestrictionStore.php b/includes/Permissions/RestrictionStore.php
index 6e504171f94..b460f1cbf22 100644
--- a/includes/Permissions/RestrictionStore.php
+++ b/includes/Permissions/RestrictionStore.php
@@ -505,7 +505,7 @@ class RestrictionStore {
 	 *
 	 * @param string $oldRestrictions Restrictions in legacy format (page.page_restrictions).
 	 *   Example: "edit=autoconfirmed,sysop:move=sysop"
-	 * @return array As returned by getAllRestrictions()
+	 * @return string[][] As returned by getAllRestrictions()
 	 * @codeCoverageIgnore We're planning to drop support for this
 	 */
 	private function convertOldRestrictions( string $oldRestrictions ): array {
diff --git a/includes/Permissions/SimpleAuthority.php b/includes/Permissions/SimpleAuthority.php
index 2188c25dcc3..8a7dbc759fe 100644
--- a/includes/Permissions/SimpleAuthority.php
+++ b/includes/Permissions/SimpleAuthority.php
@@ -39,7 +39,7 @@ class SimpleAuthority implements Authority {
 	/** @var UserIdentity */
 	private $actor;
 
-	/** @var array permissions (stored in the keys, values are ignored) */
+	/** @var true[] permissions (stored in the keys, values are ignored) */
 	private $permissions;
 
 	/**
diff --git a/includes/password/ParameterizedPassword.php b/includes/password/ParameterizedPassword.php
index e08b0845386..6e3bb57a5de 100644
--- a/includes/password/ParameterizedPassword.php
+++ b/includes/password/ParameterizedPassword.php
@@ -47,7 +47,7 @@ abstract class ParameterizedPassword extends Password {
 	/**
 	 * Extra arguments that were found in the hash. This may or may not make
 	 * the hash invalid.
-	 * @var array
+	 * @var string[]
 	 */
 	protected $args = [];
 
diff --git a/includes/password/PasswordFactory.php b/includes/password/PasswordFactory.php
index 4a6072cff97..95bf8da8888 100644
--- a/includes/password/PasswordFactory.php
+++ b/includes/password/PasswordFactory.php
@@ -39,7 +39,7 @@ final class PasswordFactory {
 	/**
 	 * Mapping of password types to classes
 	 *
-	 * @var array
+	 * @var array[]
 	 * @see PasswordFactory::register
 	 * @see Setup.php
 	 */
@@ -121,7 +121,7 @@ final class PasswordFactory {
 	/**
 	 * Get the list of types of passwords
 	 *
-	 * @return array
+	 * @return array[]
 	 */
 	public function getTypes(): array {
 		return $this->types;
diff --git a/includes/password/UserPasswordPolicy.php b/includes/password/UserPasswordPolicy.php
index e5000e13b6c..52d4aa6224b 100644
--- a/includes/password/UserPasswordPolicy.php
+++ b/includes/password/UserPasswordPolicy.php
@@ -31,7 +31,7 @@ use MediaWiki\User\UserIdentity;
 class UserPasswordPolicy {
 
 	/**
-	 * @var array
+	 * @var array[]
 	 */
 	private $policies;
 
@@ -39,13 +39,13 @@ class UserPasswordPolicy {
 	 * Mapping of statements to the function that will test the password for compliance. The
 	 * checking functions take the policy value, the user, and password, and return a Status
 	 * object indicating compliance.
-	 * @var array
+	 * @var callable[]
 	 */
 	private $policyCheckFunctions;
 
 	/**
-	 * @param array $policies
-	 * @param array $checks mapping statement to its checking function. Checking functions are
+	 * @param array[] $policies List of lists of policies per user group
+	 * @param callable[] $checks mapping statement to its checking function. Checking functions are
 	 *   called with the policy value for this user, the user object, and the password to check.
 	 */
 	public function __construct( array $policies, array $checks ) {
@@ -92,7 +92,7 @@ class UserPasswordPolicy {
 	 * be used in the installer.
 	 * @param UserIdentity $user whose policy we are checking
 	 * @param string $password the password to check
-	 * @param array $groups list of groups to which we assume the user belongs
+	 * @param string[] $groups list of groups to which we assume the user belongs
 	 * @return Status error to indicate the password didn't meet the policy, or fatal to
 	 *   indicate the user shouldn't be allowed to login. The status value will be an array,
 	 *   potentially with the following keys:
@@ -116,8 +116,8 @@ class UserPasswordPolicy {
 	/**
 	 * @param UserIdentity $user
 	 * @param string $password
-	 * @param array $policies
-	 * @param array $policyCheckFunctions
+	 * @param array $policies List of policy statements for the group the user belongs to
+	 * @param callable[] $policyCheckFunctions
 	 * @return Status
 	 */
 	private function checkPolicies( UserIdentity $user, $password, $policies, $policyCheckFunctions ) {
@@ -196,8 +196,8 @@ class UserPasswordPolicy {
 	/**
 	 * Utility function to get the effective policy from a list of policies, based
 	 * on a list of groups.
-	 * @param array $policies list of policies to consider
-	 * @param array $userGroups the groups from which we calculate the effective policy
+	 * @param array[] $policies List of lists of policies per user group
+	 * @param string[] $userGroups the groups from which we calculate the effective policy
 	 * @param array $defaultPolicy the default policy to start from
 	 * @return array effective policy
 	 */
diff --git a/includes/title/NamespaceInfo.php b/includes/title/NamespaceInfo.php
index a77f1aafe01..f1791395882 100644
--- a/includes/title/NamespaceInfo.php
+++ b/includes/title/NamespaceInfo.php
@@ -608,7 +608,7 @@ class NamespaceInfo {
 	 * @deprecated since 1.34 User PermissionManager::getNamespaceRestrictionLevels instead.
 	 * @param int $index Index to check
 	 * @param User|null $user User to check
-	 * @return array
+	 * @return string[]
 	 */
 	public function getRestrictionLevels( $index, User $user = null ) {
 		// PermissionManager is not injected because adding an explicit dependency