diff --git a/web/scripts/derive-devbox-sizes.ts b/web/scripts/derive-devbox-sizes.ts
index 8659b028ed04..167cf83ec764 100644
--- a/web/scripts/derive-devbox-sizes.ts
+++ b/web/scripts/derive-devbox-sizes.ts
@@ -22,7 +22,7 @@
  * the master already has that shape, so it is recorded without a second
  * snapshot.
  */
-import { Freestyle } from "freestyle";
+import { Freestyle, type FirewallSpec } from "freestyle";
 import { writeFileSync } from "node:fs";
 import {
   VM_IMAGE_SIZE_NAMES,
@@ -55,7 +55,7 @@ for (const name of requested) {
 const sizes = requested as VmImageSizeName[];
 const replaceSlug = hasFlag("--replace-slug");
 
-const FIREWALL = { rules: [{ action: "allow" as const, source: {}, destination: { public: true } }] };
+const FIREWALL: FirewallSpec = { rules: [{ action: "allow", source: {}, destination: { public: true } }] };
 const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
 
 type Exec = { exec: (options: { command: string; timeoutMs?: number; linuxUser?: string }) => Promise<{ stdout?: string | null; stderr?: string | null; statusCode?: number | null }> };
diff --git a/web/scripts/devbox-image-common.ts b/web/scripts/devbox-image-common.ts
index 73e6ed727f6d..9a3d042b8a92 100644
--- a/web/scripts/devbox-image-common.ts
+++ b/web/scripts/devbox-image-common.ts
@@ -362,7 +362,7 @@ export function promoteImageManifestEntry(
       }
     }
   }
-  const promotedSizes = new Set(variants.map((variant) => variant.size?.name ?? ""));
+  const promotedSizes = new Set<string>(variants.map((variant) => variant.size?.name ?? ""));
   const demoted = manifest.images.map((candidate) => {
     if (candidate.provider !== entry.provider) return candidate;
     const next: DevboxManifestEntry = { ...candidate };