diff --git a/core/Command/OCM/ActivateKey.php b/core/Command/OCM/ActivateKey.php
index 090538e0024..9efc7110a24 100644
--- a/core/Command/OCM/ActivateKey.php
+++ b/core/Command/OCM/ActivateKey.php
@@ -33,10 +33,10 @@ class ActivateKey extends Base {
 			$this->signatoryManager->activateStagedEd25519Key();
 		} catch (\RuntimeException $e) {
 			$output->writeln('<error>' . $e->getMessage() . '</error>');
-			return 1;
+			return self::FAILURE;
 		}
 		$output->writeln('<info>Staged key promoted to active.</info>');
 		$output->writeln('Run <info>occ ocm:keys:retire</info> once any in-flight signatures using the previous key have been verified.');
-		return 0;
+		return self::SUCCESS;
 	}
 }
diff --git a/core/Command/OCM/ListKeys.php b/core/Command/OCM/ListKeys.php
index f73a4763111..221beca5580 100644
--- a/core/Command/OCM/ListKeys.php
+++ b/core/Command/OCM/ListKeys.php
@@ -35,12 +35,12 @@ class ListKeys extends Base {
 		$format = $input->getOption('output');
 		if ($format === self::OUTPUT_FORMAT_JSON || $format === self::OUTPUT_FORMAT_JSON_PRETTY) {
 			$output->writeln(json_encode($keys, $format === self::OUTPUT_FORMAT_JSON_PRETTY ? JSON_PRETTY_PRINT : 0));
-			return 0;
+			return self::SUCCESS;
 		}
 
 		if ($keys === []) {
 			$output->writeln('<comment>No Ed25519 keys yet; one will be generated on first OCM request.</comment>');
-			return 0;
+			return self::SUCCESS;
 		}
 
 		$table = new Table($output);
@@ -49,6 +49,6 @@ class ListKeys extends Base {
 			$table->addRow([$key['poolId'], $key['slot'] ?? '-', $key['kid']]);
 		}
 		$table->render();
-		return 0;
+		return self::SUCCESS;
 	}
 }
diff --git a/core/Command/OCM/RetireKey.php b/core/Command/OCM/RetireKey.php
index 58db976077c..8a3c23d29c1 100644
--- a/core/Command/OCM/RetireKey.php
+++ b/core/Command/OCM/RetireKey.php
@@ -33,9 +33,9 @@ class RetireKey extends Base {
 			$this->signatoryManager->retireEd25519Key();
 		} catch (\RuntimeException $e) {
 			$output->writeln('<error>' . $e->getMessage() . '</error>');
-			return 1;
+			return self::FAILURE;
 		}
 		$output->writeln('<info>Retiring key deleted.</info>');
-		return 0;
+		return self::SUCCESS;
 	}
 }
diff --git a/core/Command/OCM/StageKey.php b/core/Command/OCM/StageKey.php
index 75437f460bf..f79d09c876a 100644
--- a/core/Command/OCM/StageKey.php
+++ b/core/Command/OCM/StageKey.php
@@ -33,10 +33,10 @@ class StageKey extends Base {
 			$signatory = $this->signatoryManager->stageEd25519Key();
 		} catch (\RuntimeException $e) {
 			$output->writeln('<error>' . $e->getMessage() . '</error>');
-			return 1;
+			return self::FAILURE;
 		}
 		$output->writeln('Staged new Ed25519 key: <info>' . $signatory->getKeyId() . '</info>');
 		$output->writeln('Wait for federated peers to refresh their JWKS cache before activating.');
-		return 0;
+		return self::SUCCESS;
 	}
 }
diff --git a/lib/private/Security/Signature/Model/Rfc9421IncomingSignedRequest.php b/lib/private/Security/Signature/Model/Rfc9421IncomingSignedRequest.php
index 3af3f7c0f8d..7e93da4ebbf 100644
--- a/lib/private/Security/Signature/Model/Rfc9421IncomingSignedRequest.php
+++ b/lib/private/Security/Signature/Model/Rfc9421IncomingSignedRequest.php
@@ -294,7 +294,7 @@ class Rfc9421IncomingSignedRequest extends SignedRequest implements
 	 * lowercased name. Derived components (`@*`) are produced inside
 	 * {@see SignatureBase}; we only collect plain fields here.
 	 *
-	 * @return array<string, string>
+	 * @return array<lowercase-string, non-empty-string>
 	 */
 	private function collectHeaders(): array {
 		$out = [];