diff --git a/src/porchlight/app.py b/src/porchlight/app.py
index bfd350f..762df61 100644
--- a/src/porchlight/app.py
+++ b/src/porchlight/app.py
@@ -110,16 +110,16 @@ def create_app(settings: Settings | None = None) -> FastAPI:
     # Session middleware
     session_secret = settings.session_secret or secrets.token_hex(32)
     app.add_middleware(
-        CSRFMiddleware,
+        CSRFMiddleware,  # ty: ignore[invalid-argument-type]
         exempt_paths={"/token", "/userinfo"},
         check_origin=settings.issuer,
     )
     app.add_middleware(
-        SessionMiddleware,
+        SessionMiddleware,  # ty: ignore[invalid-argument-type]
         secret_key=session_secret,
         same_site="lax",
         https_only=settings.session_https_only,
-    )  # type: ignore[arg-type]
+    )
 
     # Templates
     templates = Jinja2Templates(directory=str(PACKAGE_DIR / "templates"))
diff --git a/tests/test_auth_routes/test_last_credential_guard.py b/tests/test_auth_routes/test_last_credential_guard.py
index 33d2f4f..1d80133 100644
--- a/tests/test_auth_routes/test_last_credential_guard.py
+++ b/tests/test_auth_routes/test_last_credential_guard.py
@@ -4,9 +4,9 @@ from datetime import UTC, datetime
 from argon2 import PasswordHasher
 from httpx import AsyncClient
 
-from tests.conftest import get_csrf_token
 from porchlight.authn.password import PasswordService
 from porchlight.models import PasswordCredential, User, WebAuthnCredential
+from tests.conftest import get_csrf_token
 
 
 async def _create_user_and_login(client: AsyncClient) -> str:
diff --git a/tests/test_auth_routes/test_manage_credentials_page.py b/tests/test_auth_routes/test_manage_credentials_page.py
index 42c0a84..7180523 100644
--- a/tests/test_auth_routes/test_manage_credentials_page.py
+++ b/tests/test_auth_routes/test_manage_credentials_page.py
@@ -3,9 +3,9 @@ from datetime import UTC, datetime
 from argon2 import PasswordHasher
 from httpx import AsyncClient
 
-from tests.conftest import get_csrf_token
 from porchlight.authn.password import PasswordService
 from porchlight.models import PasswordCredential, User
+from tests.conftest import get_csrf_token
 
 
 async def _login(client: AsyncClient, username: str = "alice", password: str = "testpass") -> None:
diff --git a/tests/test_auth_routes/test_manage_password_credential.py b/tests/test_auth_routes/test_manage_password_credential.py
index 55b3047..787af30 100644
--- a/tests/test_auth_routes/test_manage_password_credential.py
+++ b/tests/test_auth_routes/test_manage_password_credential.py
@@ -3,9 +3,9 @@ from datetime import UTC, datetime
 from argon2 import PasswordHasher
 from httpx import AsyncClient
 
-from tests.conftest import get_csrf_token
 from porchlight.authn.password import PasswordService
 from porchlight.models import PasswordCredential, User, WebAuthnCredential
+from tests.conftest import get_csrf_token
 
 
 async def _create_user_and_login(client: AsyncClient) -> str:
diff --git a/tests/test_auth_routes/test_manage_webauthn_credential.py b/tests/test_auth_routes/test_manage_webauthn_credential.py
index 09ddf3b..d3c2b0f 100644
--- a/tests/test_auth_routes/test_manage_webauthn_credential.py
+++ b/tests/test_auth_routes/test_manage_webauthn_credential.py
@@ -17,9 +17,9 @@ from fido2.webauthn import (
 )
 from httpx import AsyncClient
 
-from tests.conftest import get_csrf_token
 from porchlight.authn.password import PasswordService
 from porchlight.models import PasswordCredential, User, WebAuthnCredential
+from tests.conftest import get_csrf_token
 
 RP_ID = "localhost"
 ORIGIN = "http://localhost:8000"
diff --git a/tests/test_auth_routes/test_password_login.py b/tests/test_auth_routes/test_password_login.py
index 5a75116..5893c2a 100644
--- a/tests/test_auth_routes/test_password_login.py
+++ b/tests/test_auth_routes/test_password_login.py
@@ -3,9 +3,9 @@ from datetime import UTC, datetime
 from argon2 import PasswordHasher
 from httpx import AsyncClient
 
-from tests.conftest import get_csrf_token
 from porchlight.authn.password import PasswordService
 from porchlight.models import PasswordCredential, User
+from tests.conftest import get_csrf_token
 
 
 async def test_password_login_unknown_user_returns_error_fragment(client: AsyncClient) -> None:
diff --git a/tests/test_auth_routes/test_webauthn_login.py b/tests/test_auth_routes/test_webauthn_login.py
index 9475e3c..5952633 100644
--- a/tests/test_auth_routes/test_webauthn_login.py
+++ b/tests/test_auth_routes/test_webauthn_login.py
@@ -6,8 +6,8 @@ from fido2.cose import ES256
 from fido2.webauthn import Aaguid, AttestedCredentialData
 from httpx import AsyncClient
 
-from tests.conftest import get_csrf_token
 from porchlight.models import User, WebAuthnCredential
+from tests.conftest import get_csrf_token
 
 RP_ID = "localhost"
 ORIGIN = "http://localhost:8000"
diff --git a/tests/test_oidc/test_consent_flow.py b/tests/test_oidc/test_consent_flow.py
index bcf778f..cc5ac9f 100644
--- a/tests/test_oidc/test_consent_flow.py
+++ b/tests/test_oidc/test_consent_flow.py
@@ -5,9 +5,9 @@ from urllib.parse import parse_qs, urlparse
 from argon2 import PasswordHasher
 from httpx import AsyncClient
 
-from tests.conftest import get_csrf_token
 from porchlight.authn.password import PasswordService
 from porchlight.models import PasswordCredential, User
+from tests.conftest import get_csrf_token
 
 
 async def test_authorization_shows_consent_for_new_client(client: AsyncClient) -> None:
diff --git a/tests/test_oidc/test_e2e_flow.py b/tests/test_oidc/test_e2e_flow.py
index d2851c9..def10ae 100644
--- a/tests/test_oidc/test_e2e_flow.py
+++ b/tests/test_oidc/test_e2e_flow.py
@@ -9,9 +9,9 @@ from cryptojwt.jwk.jwk import key_from_jwk_dict
 from cryptojwt.jws.jws import JWS
 from httpx import AsyncClient
 
-from tests.conftest import get_csrf_token
 from porchlight.authn.password import PasswordService
 from porchlight.models import PasswordCredential, User
+from tests.conftest import get_csrf_token
 
 
 async def test_full_authorization_code_flow(client: AsyncClient) -> None:
diff --git a/tests/test_oidc/test_login_oidc_redirect.py b/tests/test_oidc/test_login_oidc_redirect.py
index 7e50832..ce3083b 100644
--- a/tests/test_oidc/test_login_oidc_redirect.py
+++ b/tests/test_oidc/test_login_oidc_redirect.py
@@ -4,9 +4,9 @@ from datetime import UTC, datetime
 from argon2 import PasswordHasher
 from httpx import AsyncClient
 
-from tests.conftest import get_csrf_token
 from porchlight.authn.password import PasswordService
 from porchlight.models import PasswordCredential, User
+from tests.conftest import get_csrf_token
 
 
 def _register_test_client(client: AsyncClient) -> None:
diff --git a/tests/test_oidc/test_token.py b/tests/test_oidc/test_token.py
index 593409e..e15a4b6 100644
--- a/tests/test_oidc/test_token.py
+++ b/tests/test_oidc/test_token.py
@@ -6,9 +6,9 @@ from urllib.parse import parse_qs, urlparse
 from argon2 import PasswordHasher
 from httpx import AsyncClient
 
-from tests.conftest import get_csrf_token
 from porchlight.authn.password import PasswordService
 from porchlight.models import PasswordCredential, User
+from tests.conftest import get_csrf_token
 
 
 def _register_test_client(client: AsyncClient) -> str:
diff --git a/tests/test_oidc/test_userinfo.py b/tests/test_oidc/test_userinfo.py
index 40c2a3d..fd23021 100644
--- a/tests/test_oidc/test_userinfo.py
+++ b/tests/test_oidc/test_userinfo.py
@@ -6,9 +6,9 @@ from urllib.parse import parse_qs, urlparse
 from argon2 import PasswordHasher
 from httpx import AsyncClient
 
-from tests.conftest import get_csrf_token
 from porchlight.authn.password import PasswordService
 from porchlight.models import PasswordCredential, User
+from tests.conftest import get_csrf_token
 
 
 def _register_test_client(client: AsyncClient) -> str: