diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7243863..07fd9be 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -142,6 +142,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Tooling
 
+- Bumped PHPStan from `level: 8` to `level: max` in `phpstan.neon`.
+  The preceding PRs in the 5.0 series (constructor option shapes,
+  JSON-payload narrowing, claim shape on `validateIdToken`, JWKS
+  validation, test-side Mockery / fixture / claim narrowings) cleared
+  every max-level error; the bump is the final one-line config
+  change that locks in the strictest analysis level for future
+  contributions.
 - `OpenIdConfigurationProvider::__construct` now declares an
   `array{cacheItemPool?: CacheItemPoolInterface,
   openIDConnectMetadataUrl?: string, cacheDuration?: int, leeway?: int,
diff --git a/phpstan.neon b/phpstan.neon
index 6e3ce04..c39bc0d 100644
--- a/phpstan.neon
+++ b/phpstan.neon
@@ -2,7 +2,7 @@ includes:
 	- vendor/phpstan/phpstan-mockery/extension.neon
 
 parameters:
-	level: 8
+	level: max
 	paths:
 		- src
 		- tests