diff --git a/includes/auth/AuthenticationRequest.php b/includes/auth/AuthenticationRequest.php
index e7527d156f9..168ae851af5 100644
--- a/includes/auth/AuthenticationRequest.php
+++ b/includes/auth/AuthenticationRequest.php
@@ -246,13 +246,18 @@ abstract class AuthenticationRequest {
 	}
 
 	/**
+	 * @codingStandardsIgnoreStart
+	 * @template T
+	 * @codingStandardsIgnoreEnd
 	 * Select a request by class name.
 	 * @param AuthenticationRequest[] $reqs
 	 * @param string $class Class name
+	 * @phan-param class-string<T> $class
 	 * @param bool $allowSubclasses If true, also returns any request that's a subclass of the given
 	 *   class.
 	 * @return AuthenticationRequest|null Returns null if there is not exactly
 	 *  one matching request.
+	 * @phan-return T|null
 	 */
 	public static function getRequestByClass( array $reqs, $class, $allowSubclasses = false ) {
 		$requests = array_filter( $reqs, function ( $req ) use ( $class, $allowSubclasses ) {
diff --git a/includes/auth/ResetPasswordSecondaryAuthenticationProvider.php b/includes/auth/ResetPasswordSecondaryAuthenticationProvider.php
index c831fc8c440..25a17544f1f 100644
--- a/includes/auth/ResetPasswordSecondaryAuthenticationProvider.php
+++ b/includes/auth/ResetPasswordSecondaryAuthenticationProvider.php
@@ -96,7 +96,9 @@ class ResetPasswordSecondaryAuthenticationProvider extends AbstractSecondaryAuth
 			}
 		}
 
+		/** @var PasswordAuthenticationRequest $needReq */
 		$needReq = $data->req ?? new PasswordAuthenticationRequest();
+		'@phan-var PasswordAuthenticationRequest $needReq';
 		if ( !$needReq->action ) {
 			$needReq->action = AuthManager::ACTION_CHANGE;
 		}