diff --git a/core/polyfills.php b/core/polyfills.php
index b5fa8f7a..c82c53a2 100644
--- a/core/polyfills.php
+++ b/core/polyfills.php
@@ -659,6 +659,7 @@ function validate_input(array $inputs): array
             }
             $outputs[$key] = $id;
         } elseif (in_array('user_name', $flags)) {
+            // @phpstan-ignore-next-line - phpstan thinks $value can never be empty?
             if (strlen($value) < 1) {
                 throw new InvalidInput("Username must be at least 1 character");
             } elseif (!preg_match('/^[a-zA-Z0-9-_]+$/', $value)) {
diff --git a/core/testcase.php b/core/testcase.php
index 146298ef..8995f92d 100644
--- a/core/testcase.php
+++ b/core/testcase.php
@@ -67,6 +67,7 @@ if(class_exists("\\PHPUnit\\Framework\\TestCase")) {
             if (is_null(User::by_name($name))) {
                 $userPage = new UserPage();
                 $userPage->onUserCreation(new UserCreationEvent($name, $name, $name, "$name@$name.com", false));
+                // @phpstan-ignore-next-line - ???
                 assert(!is_null(User::by_name($name)), "Creation of user $name failed");
             }
         }
diff --git a/core/util.php b/core/util.php
index 6507a6ba..e52acf4c 100644
--- a/core/util.php
+++ b/core/util.php
@@ -151,6 +151,7 @@ function check_im_version(): int
 function is_trusted_proxy(): bool
 {
     $ra = $_SERVER['REMOTE_ADDR'] ?? "0.0.0.0";
+    // @phpstan-ignore-next-line - TRUSTED_PROXIES is defined in config
     foreach(TRUSTED_PROXIES as $proxy) {
         if(ip_in_range($ra, $proxy)) {
             return true;
@@ -615,6 +616,7 @@ function _set_up_shimmie_environment(): void
     // The trace system has a certain amount of memory consumption every time it is used,
     // so to prevent running out of memory during complex operations code that uses it should
     // check if tracer output is enabled before making use of it.
+    // @phpstan-ignore-next-line - TRACE_FILE is defined in config
     $tracer_enabled = !is_null('TRACE_FILE');
 }
 
diff --git a/ext/handle_ico/main.php b/ext/handle_ico/main.php
index ada973e9..cecb30d5 100644
--- a/ext/handle_ico/main.php
+++ b/ext/handle_ico/main.php
@@ -17,7 +17,7 @@ class IcoFileHandler extends DataHandlerExtension
 
         $fp = fopen($event->image->get_image_filename(), "r");
         try {
-            unpack("Snull/Stype/Scount", fread($fp, 6));
+            fseek($fp, 6); // skip header
             $subheader = unpack("Cwidth/Cheight/Ccolours/Cnull/Splanes/Sbpp/Lsize/loffset", fread($fp, 16));
             $width = $subheader['width'];
             $height = $subheader['height'];
diff --git a/tests/phpstan.neon b/tests/phpstan.neon
index 100af3fd..38f367fa 100644
--- a/tests/phpstan.neon
+++ b/tests/phpstan.neon
@@ -1,6 +1,6 @@
 parameters:
   errorFormat: raw
-  level: 3
+  level: 4
   paths:
     - ../core
     - ../ext
diff --git a/themes/danbooru2/view.theme.php b/themes/danbooru2/view.theme.php
index febb71f4..bfc44db0 100644
--- a/themes/danbooru2/view.theme.php
+++ b/themes/danbooru2/view.theme.php
@@ -55,6 +55,7 @@ class CustomViewPostTheme extends ViewPostTheme
             if ($image->rating === null || $image->rating == "?") {
                 $image->rating = "?";
             }
+            // @phpstan-ignore-next-line - ???
             if (Extension::is_enabled(RatingsInfo::KEY)) {
                 $h_rating = Ratings::rating_to_human($image->rating);
                 $html .= "<br>Rating: $h_rating";
diff --git a/themes/rule34v2/page.class.php b/themes/rule34v2/page.class.php
index d66253fe..4e56bc82 100644
--- a/themes/rule34v2/page.class.php
+++ b/themes/rule34v2/page.class.php
@@ -81,6 +81,7 @@ EOD;
         }
 
         $query = !empty(CustomIndexTheme::$_search_query) ? html_escape(Tag::implode(CustomIndexTheme::$_search_query)) : "";
+        // @phpstan-ignore-next-line - yes this is deliberately asserting a constant
         assert(!is_null($query));  # used in header.inc, do not remove :P
         $flash_html = $this->flash ? "<b id='flash'>".nl2br(html_escape(implode("\n", $this->flash)))."</b>" : "";
         $generated = autodate(date('c'));