diff --git a/composer.json b/composer.json
index 88f2f30..da4eba6 100644
--- a/composer.json
+++ b/composer.json
@@ -18,14 +18,15 @@
         "wp-cli/wp-cli": "^2.12"
     },
     "require-dev": {
-        "wp-cli/wp-cli-tests": "^4.3.9"
+        "wp-cli/wp-cli-tests": "^5.0.0"
     },
     "config": {
         "process-timeout": 7200,
         "sort-packages": true,
         "allow-plugins": {
             "dealerdirect/phpcodesniffer-composer-installer": true,
-            "johnpbloch/wordpress-core-installer": true
+            "johnpbloch/wordpress-core-installer": true,
+            "phpstan/extension-installer": true
         },
         "lock": false
     },
@@ -34,12 +35,14 @@
         "behat-rerun": "rerun-behat-tests",
         "lint": "run-linter-tests",
         "phpcs": "run-phpcs-tests",
+        "phpstan": "run-phpstan-tests",
         "phpcbf": "run-phpcbf-cleanup",
         "phpunit": "run-php-unit-tests",
         "prepare-tests": "install-package-tests",
         "test": [
             "@lint",
             "@phpcs",
+            "@phpstan",
             "@phpunit",
             "@behat"
         ]
diff --git a/phpstan.neon.dist b/phpstan.neon.dist
new file mode 100644
index 0000000..910c8e0
--- /dev/null
+++ b/phpstan.neon.dist
@@ -0,0 +1,13 @@
+parameters:
+  level: 9
+  paths:
+    - src
+    - find-command.php
+  scanDirectories:
+    - vendor/wp-cli/wp-cli/php
+  scanFiles:
+    - vendor/php-stubs/wordpress-stubs/wordpress-stubs.php
+  treatPhpDocTypesAsCertain: false
+  ignoreErrors:
+    - identifier: missingType.parameter
+    - identifier: missingType.return
diff --git a/src/Find_Command.php b/src/Find_Command.php
index 4498397..f2a0fe5 100644
--- a/src/Find_Command.php
+++ b/src/Find_Command.php
@@ -8,7 +8,7 @@ class Find_Command {
 	/**
 	 * Paths we can probably ignore recursion into.
 	 *
-	 * @var array
+	 * @var array<string>
 	 */
 	private $ignored_paths = [
 		// System directories
@@ -94,21 +94,21 @@ class Find_Command {
 	/**
 	 * Start time for the script.
 	 *
-	 * @var integer
+	 * @var float
 	 */
-	private $start_time = false;
+	private $start_time;
 
 	/**
 	 * Resolved alias paths
 	 *
-	 * @var array
+	 * @var array<string, string>
 	 */
 	private $resolved_aliases = [];
 
 	/**
 	 * Found WordPress installations.
 	 *
-	 * @var array
+	 * @var array<string, array<string, mixed>>
 	 */
 	private $found_wp = [];
 
@@ -190,7 +190,7 @@ class Find_Command {
 	 */
 	public function __invoke( $args, $assoc_args ) {
 		list( $path )    = $args;
-		$this->base_path = realpath( $path );
+		$this->base_path = (string) realpath( $path );
 		if ( ! $this->base_path ) {
 			WP_CLI::error( 'Invalid path specified.' );
 		}
@@ -235,7 +235,7 @@ private function recurse_directory( $path ) {
 		// Don't recurse directories that probably don't have a WordPress installation.
 		if ( ! $this->skip_ignored_paths ) {
 			// Assume base path doesn't need comparison
-			$compared_path = preg_replace( '#^' . preg_quote( $this->base_path, '#' ) . '#', '', $path );
+			$compared_path = (string) preg_replace( '#^' . preg_quote( $this->base_path, '#' ) . '#', '', $path );
 			// Ignore all hidden system directories
 			$bits        = explode( '/', trim( $compared_path, '/' ) );
 			$current_dir = array_pop( $bits );
@@ -276,7 +276,7 @@ private function recurse_directory( $path ) {
 				try {
 					$transformer = new WPConfigTransformer( $config_path );
 					foreach ( [ 'db_host', 'db_name', 'db_user' ] as $constant ) {
-						$value = $transformer->get_value( 'constant', strtoupper( $constant ) );
+						$value = (string) $transformer->get_value( 'constant', strtoupper( $constant ) );
 						// Clean up strings.
 						$first = substr( $value, 0, 1 );
 						$last  = substr( $value, -1 );
@@ -309,6 +309,10 @@ private function recurse_directory( $path ) {
 			return;
 		}
 		$this->log( "Recursing into '{$path}'" );
+
+		/**
+		 * @var SplFileInfo $file_info
+		 */
 		foreach ( $iterator as $file_info ) {
 			if ( $file_info->isDir() ) {
 				++$this->current_depth;
@@ -322,7 +326,7 @@ private function recurse_directory( $path ) {
 	 * Get the WordPress version for the installation, without executing the file.
 	 */
 	private static function get_wp_version( $path ) {
-		$contents = file_get_contents( $path );
+		$contents = (string) file_get_contents( $path );
 		preg_match( '#\$wp_version\s?=\s?[\'"]([^\'"]+)[\'"]#', $contents, $matches );
 		return ! empty( $matches[1] ) ? $matches[1] : '';
 	}
@@ -359,7 +363,7 @@ private function log( $message ) {
 	/**
 	 * Format a log timestamp into something human-readable.
 	 *
-	 * @param integer $s Log time in seconds
+	 * @param int|float $s Log time in seconds
 	 * @return string
 	 */
 	private static function format_log_timestamp( $s ) {