diff --git a/grizzly/target/puppet_target.py b/grizzly/target/puppet_target.py
index a4cda8b8..235a6627 100644
--- a/grizzly/target/puppet_target.py
+++ b/grizzly/target/puppet_target.py
@@ -9,7 +9,7 @@
 from signal import SIGABRT, Signals
 from tempfile import TemporaryDirectory, mkdtemp
 from time import sleep, time
-from typing import Dict, Optional, Set, cast
+from typing import Any, Dict, Optional, Set, cast
 
 try:
     from signal import SIGUSR1  # pylint: disable=ungrouped-imports
@@ -24,6 +24,8 @@
 from prefpicker import PrefPicker
 from psutil import AccessDenied, NoSuchProcess, Process, process_iter, wait_procs
 
+from sapphire import CertificateBundle
+
 from ..common.report import Report
 from ..common.utils import grz_tmp
 from .target import Result, Target, TargetLaunchError, TargetLaunchTimeout
@@ -100,9 +102,9 @@ def __init__(
         launch_timeout: int,
         log_limit: int,
         memory_limit: int,
-        **kwds,
+        **kwds: Dict[str, Any],
     ) -> None:
-        certs = kwds.pop("certs", None)
+        certs = cast(Optional[CertificateBundle], kwds.pop("certs", None))
         # only pass certs to FFPuppet if certutil is available
         # otherwise certs can't be used
         if certs and not certutil_available(certutil_find(binary)):
@@ -133,7 +135,7 @@ def __init__(
         # create Puppet object
         self._puppet = FFPuppet(
             debugger=self._debugger,
-            headless=kwds.pop("headless", None),
+            headless=cast(Optional[str], kwds.pop("headless", None)),
             working_path=str(grz_tmp("target")),
         )
         if kwds: