diff --git a/phpstan.baseline.neon b/phpstan.baseline.neon
index d939412ff..eb50532a0 100644
--- a/phpstan.baseline.neon
+++ b/phpstan.baseline.neon
@@ -915,12 +915,6 @@ parameters:
 			count: 2
 			path: src/Infrastructure/Adapter/In/Web/Controllers/Account/SaveRequestController.php
 
-		-
-			message: '#^Cannot call method getData\(\) on array\|object\.$#'
-			identifier: method.nonObject
-			count: 1
-			path: src/Infrastructure/Adapter/In/Web/Controllers/Account/ViewLinkController.php
-
 		-
 			message: '#^Parameter \#1 \$type of method SP\\Domain\\Core\\Events\\EventMessage\<mixed\>\:\:addExtra\(\) expects class\-string\<mixed\>, string given\.$#'
 			identifier: argument.type
diff --git a/src/Domain/Common/Adapters/Serde.php b/src/Domain/Common/Adapters/Serde.php
index 2c0938306..ba7ba4631 100644
--- a/src/Domain/Common/Adapters/Serde.php
+++ b/src/Domain/Common/Adapters/Serde.php
@@ -69,8 +69,11 @@ public static function serializeJson(array|object|string|int $data, int $flags =
      *
      * @throws SPException
      */
-    public static function deserialize(string $data, ?string $class = null, string ...$nestedClasses): object|array
-    {
+    public static function deserialize(
+        string $data,
+        ?string $class = null,
+        string ...$nestedClasses
+    ): object|array|string|int {
         $value = @unserialize(
             $data,
             ['allowed_classes' => $class !== null ? [$class, ...$nestedClasses] : true]
diff --git a/src/Infrastructure/Adapter/In/Web/Controllers/Account/ViewLinkController.php b/src/Infrastructure/Adapter/In/Web/Controllers/Account/ViewLinkController.php
index 3be5c9697..249ca734f 100644
--- a/src/Infrastructure/Adapter/In/Web/Controllers/Account/ViewLinkController.php
+++ b/src/Infrastructure/Adapter/In/Web/Controllers/Account/ViewLinkController.php
@@ -110,6 +110,7 @@ public function viewLinkAction(string $hash): ActionResponse
             $this->accountService->incrementViewCounter($publicLink->getItemId());
             $this->accountService->incrementDecryptCounter($publicLink->getItemId());
 
+            /** @var Vault $vault The stored blob is a Vault; Serde answers with whatever it holds. */
             $vault = Serde::deserialize($publicLink->getData() ?? '', Vault::class, Crypt::class);
 
             $accountViewDto = AccountViewDto::fromModel(
diff --git a/tests/Unit/Domain/Common/Adapters/SerdeTest.php b/tests/Unit/Domain/Common/Adapters/SerdeTest.php
index 6d5854eca..03d0d6364 100644
--- a/tests/Unit/Domain/Common/Adapters/SerdeTest.php
+++ b/tests/Unit/Domain/Common/Adapters/SerdeTest.php
@@ -84,6 +84,21 @@ public function testDeserialize()
         $this->assertEquals('0f099212786ab8090432f2889ac37c2a977f164a', $out->attributes['configHash']);
     }
 
+    /**
+     * serialize() takes a scalar — the provider above passes a string and an int through it — so
+     * deserialize() has to hand one back. Declared as object|array, it raised a TypeError on the
+     * way out instead: anything that cached a bare string, the file cache included, could store it
+     * and never read it again.
+     *
+     * @throws SPException
+     */
+    #[DataProvider('serializeDataProvider')]
+    public function testDeserializeReturnsWhateverWasSerialized(mixed $data, string $serialized)
+    {
+        // Equals, not same: an object comes back as a copy, which is the point of serializing it.
+        self::assertEquals($data, Serde::deserialize($serialized));
+    }
+
     /**
      * @throws SPException
      */