diff --git a/src/catleg/query.py b/src/catleg/query.py
index 824aa2c..c13ebc1 100644
--- a/src/catleg/query.py
+++ b/src/catleg/query.py
@@ -211,13 +211,13 @@ def to_markdown(self) -> str:
 
 
 def _get_legifrance_credentials(*, raise_if_missing=True):
-    client_id = settings.get("lf_client_id")
-    client_secret = settings.get("lf_client_secret")
+    client_id: str | None = settings.get("lf_client_id")
+    client_secret: str | None = settings.get("lf_client_secret")
 
-    if not LF_TOKEN_REGEX.match(client_id):
+    if not LF_TOKEN_REGEX.match(client_id or ""):
         client_id = None
 
-    if not LF_TOKEN_REGEX.match(client_secret):
+    if not LF_TOKEN_REGEX.match(client_secret or ""):
         client_secret = None
 
     if raise_if_missing:
diff --git a/tox.ini b/tox.ini
index 0051766..c722b13 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,6 +1,7 @@
 [tox]
 requires =
     tox>=4
+    pip>=23.2
 env_list = format, type, lint, py{310,311,312}
 
 
@@ -20,7 +21,7 @@ description = run type checks
 deps =
     mypy>=1.2.0
 commands =
-    mypy {posargs:src}
+    mypy --check-untyped-defs {posargs:src}
 
 [testenv:format]
 description = ensure formatting is correct