diff --git a/apps/workflowengine/lib/Check/RequestRemoteAddress.php b/apps/workflowengine/lib/Check/RequestRemoteAddress.php
index b6f8fef5aedb1..ac26e99d47f75 100644
--- a/apps/workflowengine/lib/Check/RequestRemoteAddress.php
+++ b/apps/workflowengine/lib/Check/RequestRemoteAddress.php
@@ -6,11 +6,13 @@
  */
 namespace OCA\WorkflowEngine\Check;
 
+use OCP\Cache\CappedMemoryCache;
 use OCP\IL10N;
 use OCP\IRequest;
 use OCP\WorkflowEngine\ICheck;
 
 class RequestRemoteAddress implements ICheck {
+	protected CappedMemoryCache $checked;
 
 	/**
 	 * @param IL10N $l
@@ -20,6 +22,7 @@ public function __construct(
 		protected IL10N $l,
 		protected IRequest $request,
 	) {
+		$this->checked = new CappedMemoryCache();
 	}
 
 	/**
@@ -28,18 +31,24 @@ public function __construct(
 	 * @return bool
 	 */
 	public function executeCheck($operator, $value) {
+		$cacheKey = sha1($operator . $value);
+
+		if (isset($this->checked[$cacheKey])) {
+			return $this->checked[$cacheKey];
+		}
+
 		$actualValue = $this->request->getRemoteAddress();
 		$decodedValue = explode('/', $value);
 
-		if ($operator === 'matchesIPv4') {
-			return $this->matchIPv4($actualValue, $decodedValue[0], $decodedValue[1]);
-		} elseif ($operator === '!matchesIPv4') {
-			return !$this->matchIPv4($actualValue, $decodedValue[0], $decodedValue[1]);
-		} elseif ($operator === 'matchesIPv6') {
-			return $this->matchIPv6($actualValue, $decodedValue[0], $decodedValue[1]);
-		} else {
-			return !$this->matchIPv6($actualValue, $decodedValue[0], $decodedValue[1]);
-		}
+		$result = match ($operator) {
+			'matchesIPv4' => $this->matchIPv4($actualValue, $decodedValue[0], (int)$decodedValue[1]),
+			'!matchesIPv4' => !$this->matchIPv4($actualValue, $decodedValue[0], (int)$decodedValue[1]),
+			'matchesIPv6' => $this->matchIPv6($actualValue, $decodedValue[0], (int)$decodedValue[1]),
+			default => !$this->matchIPv6($actualValue, $decodedValue[0], (int)$decodedValue[1]),
+		};
+
+		$this->checked[$cacheKey] = $result;
+		return $result;
 	}
 
 	/**
diff --git a/apps/workflowengine/lib/Check/RequestTime.php b/apps/workflowengine/lib/Check/RequestTime.php
index a49986652b8ca..f9236e046632e 100644
--- a/apps/workflowengine/lib/Check/RequestTime.php
+++ b/apps/workflowengine/lib/Check/RequestTime.php
@@ -7,6 +7,7 @@
 namespace OCA\WorkflowEngine\Check;
 
 use OCP\AppFramework\Utility\ITimeFactory;
+use OCP\Cache\CappedMemoryCache;
 use OCP\IL10N;
 use OCP\WorkflowEngine\ICheck;
 
@@ -14,8 +15,7 @@ class RequestTime implements ICheck {
 	public const REGEX_TIME = '([0-1][0-9]|2[0-3]):([0-5][0-9])';
 	public const REGEX_TIMEZONE = '([a-zA-Z]+(?:\\/[a-zA-Z\-\_]+)+)';
 
-	/** @var bool[] */
-	protected $cachedResults;
+	protected CappedMemoryCache $cachedResults;
 
 	/**
 	 * @param ITimeFactory $timeFactory
@@ -24,6 +24,7 @@ public function __construct(
 		protected IL10N $l,
 		protected ITimeFactory $timeFactory,
 	) {
+		$this->cachedResults = new CappedMemoryCache();
 	}
 
 	/**
@@ -32,7 +33,7 @@ public function __construct(
 	 * @return bool
 	 */
 	public function executeCheck($operator, $value) {
-		$valueHash = md5($value);
+		$valueHash = sha1($operator . $value);
 
 		if (isset($this->cachedResults[$valueHash])) {
 			return $this->cachedResults[$valueHash];
@@ -50,7 +51,10 @@ public function executeCheck($operator, $value) {
 			$in = $timestamp1 <= $timestamp || $timestamp <= $timestamp2;
 		}
 
-		return ($operator === 'in') ? $in : !$in;
+		$result = ($operator === 'in') ? $in : !$in;
+
+		$this->cachedResults[$valueHash] = $result;
+		return $result;
 	}
 
 	/**
diff --git a/apps/workflowengine/lib/Check/RequestURL.php b/apps/workflowengine/lib/Check/RequestURL.php
index fb2ac7e8fd50a..92ef6213656a7 100644
--- a/apps/workflowengine/lib/Check/RequestURL.php
+++ b/apps/workflowengine/lib/Check/RequestURL.php
@@ -70,7 +70,7 @@ protected function isWebDAVRequest(): bool {
 		if ($this->url === RequestURL::CLI) {
 			return false;
 		}
-		return substr($this->request->getScriptName(), 0 - strlen('/remote.php')) === '/remote.php' && (
+		return str_ends_with($this->request->getScriptName(), '/remote.php') && (
 			$this->request->getPathInfo() === '/webdav'
 			|| str_starts_with($this->request->getPathInfo() ?? '', '/webdav/')
 			|| $this->request->getPathInfo() === '/dav/files'
diff --git a/build/psalm-baseline.xml b/build/psalm-baseline.xml
index 8cfb49ae27948..b2ce8989bd72a 100644
--- a/build/psalm-baseline.xml
+++ b/build/psalm-baseline.xml
@@ -2692,14 +2692,6 @@
       <code><![CDATA[null]]></code>
     </NullArgument>
   </file>
-  <file src="apps/workflowengine/lib/Check/RequestRemoteAddress.php">
-    <InvalidArgument>
-      <code><![CDATA[$decodedValue[1]]]></code>
-      <code><![CDATA[$decodedValue[1]]]></code>
-      <code><![CDATA[$decodedValue[1]]]></code>
-      <code><![CDATA[$decodedValue[1]]]></code>
-    </InvalidArgument>
-  </file>
   <file src="apps/workflowengine/lib/Check/TFileCheck.php">
     <InvalidArgument>
       <code><![CDATA[['app' => Application::APP_ID, 'class' => get_class($subject)]]]></code>
@@ -3934,13 +3926,11 @@
   </file>
   <file src="lib/private/Group/Manager.php">
     <LessSpecificReturnStatement>
-      <code><![CDATA[$groups]]></code>
       <code><![CDATA[array_values($groups)]]></code>
       <code><![CDATA[array_values($groups)]]></code>
     </LessSpecificReturnStatement>
     <MoreSpecificReturnType>
       <code><![CDATA[\OC\Group\Group[]]]></code>
-      <code><![CDATA[\OC\Group\Group[]]]></code>
     </MoreSpecificReturnType>
     <UndefinedInterfaceMethod>
       <code><![CDATA[createGroup]]></code>
diff --git a/lib/private/Group/Manager.php b/lib/private/Group/Manager.php
index c1741a8188a63..aeea6c7f0728f 100644
--- a/lib/private/Group/Manager.php
+++ b/lib/private/Group/Manager.php
@@ -287,7 +287,7 @@ public function search(string $search, ?int $limit = null, ?int $offset = 0) {
 
 	/**
 	 * @param IUser|null $user
-	 * @return \OC\Group\Group[]
+	 * @return array<string, \OCP\IGroup>
 	 */
 	public function getUserGroups(?IUser $user = null) {
 		if (!$user instanceof IUser) {
@@ -298,7 +298,7 @@ public function getUserGroups(?IUser $user = null) {
 
 	/**
 	 * @param string $uid the user id
-	 * @return \OC\Group\Group[]
+	 * @return array<string, \OCP\IGroup>
 	 */
 	public function getUserIdGroups(string $uid): array {
 		$groupIds = $this->getUserIdGroupIds($uid);