diff --git a/src/Surfnet/Stepup/Configuration/Value/AllowedSecondFactorList.php b/src/Surfnet/Stepup/Configuration/Value/AllowedSecondFactorList.php
index c40892dcf..c049b2292 100644
--- a/src/Surfnet/Stepup/Configuration/Value/AllowedSecondFactorList.php
+++ b/src/Surfnet/Stepup/Configuration/Value/AllowedSecondFactorList.php
@@ -121,7 +121,7 @@ public function getIterator()
         return new ArrayIterator($this->allowedSecondFactors);
     }
 
-    public function jsonSerialize()
+    public function jsonSerialize(): array
     {
         return $this->allowedSecondFactors;
     }
diff --git a/src/Surfnet/Stepup/Configuration/Value/ContactInformation.php b/src/Surfnet/Stepup/Configuration/Value/ContactInformation.php
index 02b0744d5..20b96978f 100644
--- a/src/Surfnet/Stepup/Configuration/Value/ContactInformation.php
+++ b/src/Surfnet/Stepup/Configuration/Value/ContactInformation.php
@@ -56,7 +56,7 @@ public function __toString(): string
         return $this->contactInformation;
     }
 
-    public function jsonSerialize()
+    public function jsonSerialize(): string
     {
         return $this->contactInformation;
     }
diff --git a/src/Surfnet/Stepup/Configuration/Value/Institution.php b/src/Surfnet/Stepup/Configuration/Value/Institution.php
index 24581e11f..c4cbf3029 100644
--- a/src/Surfnet/Stepup/Configuration/Value/Institution.php
+++ b/src/Surfnet/Stepup/Configuration/Value/Institution.php
@@ -59,7 +59,7 @@ public function __toString(): string
         return $this->institution;
     }
 
-    public function jsonSerialize()
+    public function jsonSerialize(): string
     {
         return $this->institution;
     }
diff --git a/src/Surfnet/Stepup/Configuration/Value/InstitutionAuthorizationOption.php b/src/Surfnet/Stepup/Configuration/Value/InstitutionAuthorizationOption.php
index fa49bb621..e0594da23 100644
--- a/src/Surfnet/Stepup/Configuration/Value/InstitutionAuthorizationOption.php
+++ b/src/Surfnet/Stepup/Configuration/Value/InstitutionAuthorizationOption.php
@@ -180,7 +180,7 @@ public function isDefault()
         return $this->isDefault;
     }
 
-    public function jsonSerialize()
+    public function jsonSerialize(): ?array
     {
         if ($this->isDefault) {
             return null;
diff --git a/src/Surfnet/Stepup/Configuration/Value/InstitutionConfigurationId.php b/src/Surfnet/Stepup/Configuration/Value/InstitutionConfigurationId.php
index c5c44bd0f..145f1785e 100644
--- a/src/Surfnet/Stepup/Configuration/Value/InstitutionConfigurationId.php
+++ b/src/Surfnet/Stepup/Configuration/Value/InstitutionConfigurationId.php
@@ -89,7 +89,7 @@ public function __toString(): string
         return $this->institutionConfigurationId;
     }
 
-    public function jsonSerialize()
+    public function jsonSerialize(): string
     {
         return $this->institutionConfigurationId;
     }
diff --git a/src/Surfnet/Stepup/Configuration/Value/InstitutionRole.php b/src/Surfnet/Stepup/Configuration/Value/InstitutionRole.php
index 235616096..8e702ed6b 100644
--- a/src/Surfnet/Stepup/Configuration/Value/InstitutionRole.php
+++ b/src/Surfnet/Stepup/Configuration/Value/InstitutionRole.php
@@ -91,7 +91,7 @@ public function getType()
         return $this->type;
     }
 
-    public function jsonSerialize()
+    public function jsonSerialize(): string
     {
         return $this->type;
     }
diff --git a/src/Surfnet/Stepup/Configuration/Value/Location.php b/src/Surfnet/Stepup/Configuration/Value/Location.php
index b08126f90..c06997195 100644
--- a/src/Surfnet/Stepup/Configuration/Value/Location.php
+++ b/src/Surfnet/Stepup/Configuration/Value/Location.php
@@ -59,7 +59,7 @@ public function __toString(): string
         return $this->location;
     }
 
-    public function jsonSerialize()
+    public function jsonSerialize(): string
     {
         return $this->location;
     }
diff --git a/src/Surfnet/Stepup/Configuration/Value/NumberOfTokensPerIdentityOption.php b/src/Surfnet/Stepup/Configuration/Value/NumberOfTokensPerIdentityOption.php
index 630677761..6f367f205 100644
--- a/src/Surfnet/Stepup/Configuration/Value/NumberOfTokensPerIdentityOption.php
+++ b/src/Surfnet/Stepup/Configuration/Value/NumberOfTokensPerIdentityOption.php
@@ -72,7 +72,7 @@ public function getNumberOfTokensPerIdentity()
         return $this->numberOfTokensPerIdentity;
     }
 
-    public function jsonSerialize()
+    public function jsonSerialize(): int
     {
         return $this->numberOfTokensPerIdentity;
     }
diff --git a/src/Surfnet/Stepup/Configuration/Value/RaLocationId.php b/src/Surfnet/Stepup/Configuration/Value/RaLocationId.php
index fea80723a..ffaa36baa 100644
--- a/src/Surfnet/Stepup/Configuration/Value/RaLocationId.php
+++ b/src/Surfnet/Stepup/Configuration/Value/RaLocationId.php
@@ -72,7 +72,7 @@ public function __toString(): string
         return $this->raLocationId;
     }
 
-    public function jsonSerialize()
+    public function jsonSerialize(): string
     {
         return $this->raLocationId;
     }
diff --git a/src/Surfnet/Stepup/Configuration/Value/RaLocationName.php b/src/Surfnet/Stepup/Configuration/Value/RaLocationName.php
index 079d34ca0..58a292a0e 100644
--- a/src/Surfnet/Stepup/Configuration/Value/RaLocationName.php
+++ b/src/Surfnet/Stepup/Configuration/Value/RaLocationName.php
@@ -59,7 +59,7 @@ public function __toString(): string
         return $this->raLocationName;
     }
 
-    public function jsonSerialize()
+    public function jsonSerialize(): string
     {
         return $this->raLocationName;
     }
diff --git a/src/Surfnet/Stepup/Configuration/Value/ShowRaaContactInformationOption.php b/src/Surfnet/Stepup/Configuration/Value/ShowRaaContactInformationOption.php
index 8fb17a4f8..cf1658081 100644
--- a/src/Surfnet/Stepup/Configuration/Value/ShowRaaContactInformationOption.php
+++ b/src/Surfnet/Stepup/Configuration/Value/ShowRaaContactInformationOption.php
@@ -59,7 +59,7 @@ public function isEnabled()
         return $this->showRaaContactInformationOption;
     }
 
-    public function jsonSerialize()
+    public function jsonSerialize(): bool
     {
         return $this->showRaaContactInformationOption;
     }
diff --git a/src/Surfnet/Stepup/Configuration/Value/UseRaLocationsOption.php b/src/Surfnet/Stepup/Configuration/Value/UseRaLocationsOption.php
index a358460d7..264e24fad 100644
--- a/src/Surfnet/Stepup/Configuration/Value/UseRaLocationsOption.php
+++ b/src/Surfnet/Stepup/Configuration/Value/UseRaLocationsOption.php
@@ -62,7 +62,7 @@ public function isEnabled()
         return $this->useRaLocationsOption;
     }
 
-    public function jsonSerialize()
+    public function jsonSerialize(): bool
     {
         return $this->useRaLocationsOption;
     }
diff --git a/src/Surfnet/Stepup/Configuration/Value/VerifyEmailOption.php b/src/Surfnet/Stepup/Configuration/Value/VerifyEmailOption.php
index 634f09b46..fa55f97b8 100644
--- a/src/Surfnet/Stepup/Configuration/Value/VerifyEmailOption.php
+++ b/src/Surfnet/Stepup/Configuration/Value/VerifyEmailOption.php
@@ -59,7 +59,7 @@ public function isEnabled()
         return $this->verifyEmailOption;
     }
 
-    public function jsonSerialize()
+    public function jsonSerialize(): bool
     {
         return $this->verifyEmailOption;
     }
diff --git a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/AuditLogEntry.php b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/AuditLogEntry.php
index 638a86d1d..15b28abd8 100644
--- a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/AuditLogEntry.php
+++ b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/AuditLogEntry.php
@@ -207,7 +207,7 @@ class AuditLogEntry implements JsonSerializable
     #[ORM\Column(type: 'stepup_datetime')]
     public $recordedOn;
 
-    public function jsonSerialize()
+    public function jsonSerialize(): array
     {
         return [
             'actor_id' => $this->actorId,
diff --git a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/Identity.php b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/Identity.php
index 4fa6d79b4..f60a13eb3 100644
--- a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/Identity.php
+++ b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/Identity.php
@@ -92,7 +92,7 @@ public static function create(
         return $identity;
     }
 
-    public function jsonSerialize()
+    public function jsonSerialize(): array
     {
         return [
             'id' => $this->id,
diff --git a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/IdentitySelfAssertedTokenOptions.php b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/IdentitySelfAssertedTokenOptions.php
index 8e6bf4240..3fe930bc5 100644
--- a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/IdentitySelfAssertedTokenOptions.php
+++ b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/IdentitySelfAssertedTokenOptions.php
@@ -69,7 +69,7 @@ public static function create(
         return $identitySelfAssertedTokenOptions;
     }
 
-    public function jsonSerialize()
+    public function jsonSerialize(): array
     {
         return [
             'identity_id' => (string)$this->identityId,
diff --git a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/InstitutionListing.php b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/InstitutionListing.php
index 29d6df365..ed8ef6e30 100644
--- a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/InstitutionListing.php
+++ b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/InstitutionListing.php
@@ -42,7 +42,7 @@ public static function createFrom(Institution $institution): self
         return $instance;
     }
 
-    public function jsonSerialize()
+    public function jsonSerialize(): array
     {
         return ['name' => $this->institution];
     }
diff --git a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/RaCandidate.php b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/RaCandidate.php
index 39477323e..764222a52 100644
--- a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/RaCandidate.php
+++ b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/RaCandidate.php
@@ -96,7 +96,7 @@ public static function nominate(
         return $candidate;
     }
 
-    public function jsonSerialize()
+    public function jsonSerialize(): array
     {
         return [
             'identity_id' => $this->identityId,
diff --git a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/RaListing.php b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/RaListing.php
index 75e87cb3d..51aced080 100644
--- a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/RaListing.php
+++ b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/RaListing.php
@@ -120,7 +120,7 @@ public static function create(
         return $entry;
     }
 
-    public function jsonSerialize()
+    public function jsonSerialize(): array
     {
         return [
             'identity_id' => $this->identityId,
diff --git a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/RaSecondFactor.php b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/RaSecondFactor.php
index 1eaff9796..e7d6be771 100644
--- a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/RaSecondFactor.php
+++ b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/RaSecondFactor.php
@@ -105,7 +105,7 @@ public function __construct(
         $this->status = SecondFactorStatus::unverified();
     }
 
-    public function jsonSerialize()
+    public function jsonSerialize(): array
     {
         return [
             'id' => $this->id,
diff --git a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/RecoveryToken.php b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/RecoveryToken.php
index 24bbc565c..bd8b89802 100644
--- a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/RecoveryToken.php
+++ b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/RecoveryToken.php
@@ -79,7 +79,7 @@ class RecoveryToken implements JsonSerializable
     #[ORM\Column(length: 255)]
     public $recoveryMethodIdentifier;
 
-    public function jsonSerialize()
+    public function jsonSerialize(): array
     {
         return [
             'id' => $this->id,
diff --git a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/UnverifiedSecondFactor.php b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/UnverifiedSecondFactor.php
index ab6cc27d3..898f02176 100644
--- a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/UnverifiedSecondFactor.php
+++ b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/UnverifiedSecondFactor.php
@@ -58,7 +58,7 @@ class UnverifiedSecondFactor implements JsonSerializable
     #[ORM\Column(length: 32)]
     public $verificationNonce;
 
-    public function jsonSerialize()
+    public function jsonSerialize(): array
     {
         return [
             'id' => $this->id,
diff --git a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/VerifiedSecondFactor.php b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/VerifiedSecondFactor.php
index 50dbb1b09..5089db855 100644
--- a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/VerifiedSecondFactor.php
+++ b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/VerifiedSecondFactor.php
@@ -78,7 +78,7 @@ class VerifiedSecondFactor implements JsonSerializable
     #[ORM\Column(type: 'stepup_datetime')]
     public $registrationRequestedAt;
 
-    public function jsonSerialize()
+    public function jsonSerialize(): array
     {
         return [
             'id' => $this->id,
diff --git a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/VettedSecondFactor.php b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/VettedSecondFactor.php
index 838dd9784..12e6386ce 100644
--- a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/VettedSecondFactor.php
+++ b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/VettedSecondFactor.php
@@ -77,7 +77,7 @@ public function vettingType(): string
         return $this->vettingType;
     }
 
-    public function jsonSerialize()
+    public function jsonSerialize(): array
     {
         return [
             'id' => $this->id,
diff --git a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/VettingTypeHint.php b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/VettingTypeHint.php
index 4e355186c..eda25072f 100644
--- a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/VettingTypeHint.php
+++ b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/VettingTypeHint.php
@@ -33,7 +33,7 @@ class VettingTypeHint implements JsonSerializable
     #[ORM\Column(type: 'stepup_vetting_type_hints')]
     public VettingTypeHintCollection $hints;
 
-    public function jsonSerialize()
+    public function jsonSerialize(): array
     {
         return [
             'institution' => $this->institution,
diff --git a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/WhitelistEntry.php b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/WhitelistEntry.php
index 6449b0b8d..437054d5f 100644
--- a/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/WhitelistEntry.php
+++ b/src/Surfnet/StepupMiddleware/ApiBundle/Identity/Entity/WhitelistEntry.php
@@ -38,7 +38,7 @@ public static function createFrom(Institution $institution): self
         return $instance;
     }
 
-    public function jsonSerialize()
+    public function jsonSerialize(): string
     {
         return $this->institution;
     }
diff --git a/src/Surfnet/StepupMiddleware/ApiBundle/Tests/Authorization/Service/AuthorizationServiceTest.php b/src/Surfnet/StepupMiddleware/ApiBundle/Tests/Authorization/Service/AuthorizationServiceTest.php
index c0fa759f6..46a2e78b4 100644
--- a/src/Surfnet/StepupMiddleware/ApiBundle/Tests/Authorization/Service/AuthorizationServiceTest.php
+++ b/src/Surfnet/StepupMiddleware/ApiBundle/Tests/Authorization/Service/AuthorizationServiceTest.php
@@ -18,6 +18,7 @@
 
 namespace Surfnet\StepupMiddleware\ApiBundle\Tests\Authorization\Service;
 
+use Doctrine\Common\Collections\ArrayCollection;
 use Mockery as m;
 use Pagerfanta\Pagerfanta;
 use PHPUnit\Framework\TestCase;
@@ -473,7 +474,7 @@ public function test_it_allows_self_vetting_when_one_sat_present(): void
         $vettedSecondFactor->vettingType = VettingType::TYPE_SELF_ASSERTED_REGISTRATION;
 
         $collection = m::mock(Pagerfanta::class);
-        $collection->shouldReceive('getIterator')->andReturn([$vettedSecondFactor]);
+        $collection->shouldReceive('getIterator')->andReturn(new ArrayCollection([$vettedSecondFactor]));
 
         $this->secondFactorService
             ->shouldReceive('searchVettedSecondFactors')
@@ -509,7 +510,7 @@ public function test_it_allows_self_vetting_when_multiple_sat_present(): void
         $vettedSecondFactor->vettingType = VettingType::TYPE_SELF_ASSERTED_REGISTRATION;
 
         $collection = m::mock(Pagerfanta::class);
-        $collection->shouldReceive('getIterator')->andReturn([$vettedSecondFactor, $vettedSecondFactor]);
+        $collection->shouldReceive('getIterator')->andReturn(new ArrayCollection([$vettedSecondFactor, $vettedSecondFactor]));
 
         $this->secondFactorService
             ->shouldReceive('searchVettedSecondFactors')
@@ -546,7 +547,7 @@ public function test_it_denies_self_vetting_when_other_vetting_type(): void
         $vettedSecondFactor->vettingType = VettingType::TYPE_ON_PREMISE;
 
         $collection = m::mock(Pagerfanta::class);
-        $collection->shouldReceive('getIterator')->andReturn([$vettedSecondFactor, $vettedSecondFactor]);
+        $collection->shouldReceive('getIterator')->andReturn(new ArrayCollection([$vettedSecondFactor, $vettedSecondFactor]));
 
         $this->secondFactorService
             ->shouldReceive('searchVettedSecondFactors')