diff --git a/composer.lock b/composer.lock
index 50cd6c148..aca35cc86 100644
--- a/composer.lock
+++ b/composer.lock
@@ -3465,11 +3465,11 @@
         },
         {
             "name": "phpstan/phpstan",
-            "version": "2.2.9",
+            "version": "2.2.12",
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/13d6b4f347bad222da436580c8304fa6f83e6bd0",
-                "reference": "13d6b4f347bad222da436580c8304fa6f83e6bd0",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/174b0d88710f00a42598886504dd7a146f91ace5",
+                "reference": "174b0d88710f00a42598886504dd7a146f91ace5",
                 "shasum": ""
             },
             "require": {
@@ -3525,7 +3525,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-08-22T07:38:16+00:00"
+            "time": "2026-08-31T19:09:43+00:00"
         },
         {
             "name": "phpunit/php-code-coverage",
diff --git a/phpstan.baseline.neon b/phpstan.baseline.neon
index f5cbd4942..ccc406bef 100644
--- a/phpstan.baseline.neon
+++ b/phpstan.baseline.neon
@@ -198,12 +198,6 @@ parameters:
 			count: 1
 			path: src/Domain/Account/Adapters/AccountPermission.php
 
-		-
-			message: '#^Instanceof between SP\\Domain\\Common\\Models\\Item and SP\\Domain\\Common\\Models\\Item will always evaluate to true\.$#'
-			identifier: instanceof.alwaysTrue
-			count: 1
-			path: src/Domain/Account/Dtos/AccountEnrichedDto.php
-
 		-
 			message: '#^Instanceof between SP\\Domain\\Account\\Dtos\\AccountUpdateDto and SP\\Domain\\Account\\Dtos\\AccountUpdateDto will always evaluate to true\.$#'
 			identifier: instanceof.alwaysTrue
diff --git a/src/Domain/Common/Dtos/ItemDataTrait.php b/src/Domain/Common/Dtos/ItemDataTrait.php
index 7230d5167..902a89e34 100644
--- a/src/Domain/Common/Dtos/ItemDataTrait.php
+++ b/src/Domain/Common/Dtos/ItemDataTrait.php
@@ -33,12 +33,21 @@
 trait ItemDataTrait
 {
     /**
-     * @param Item[] $items
+     * Keep only the `Item`s out of whatever was handed over.
+     *
+     * The parameter is deliberately `mixed[]` rather than `Item[]`: every caller takes a bare
+     * `array` at runtime — `AccountAclDto`'s constructor and `AccountEnrichedDto`'s `with*()`
+     * methods all declare `array $x` — and the values arrive from the database and from
+     * deserialized DTOs, so this filter is the thing that makes the array an `Item[]`. Annotating
+     * the input as `Item[]` claimed the guarantee this method exists to provide, which is why
+     * PHPStan 2.2.12 began reporting the `instanceof` as always true.
+     *
+     * @param mixed[] $items
      *
      * @return Item[]
      */
     private static function buildFromItemData(array $items): array
     {
-        return array_filter($items, static fn($value) => $value instanceof Item);
+        return array_filter($items, static fn(mixed $value): bool => $value instanceof Item);
     }
 }