diff --git a/composer.json b/composer.json
index f728463..91adcf1 100644
--- a/composer.json
+++ b/composer.json
@@ -13,7 +13,7 @@
         "guzzlehttp/psr7": "^1.6"
     },
     "require-dev": {
-        "sminnee/phpunit": "^5.7",
+        "phpunit/phpunit": "^9",
         "squizlabs/php_codesniffer": "^3"
     },
     "autoload": {
diff --git a/phpunit.xml.dist b/phpunit.xml.dist
index 50c87b7..c837a98 100644
--- a/phpunit.xml.dist
+++ b/phpunit.xml.dist
@@ -1,7 +1,9 @@
 <phpunit bootstrap="vendor/silverstripe/cms/tests/bootstrap.php" colors="true">
-    <testsuite name="webauthn">
-        <directory>tests/</directory>
-    </testsuite>
+    <testsuites>
+        <testsuite name="webauthn">
+            <directory>tests/</directory>
+        </testsuite>
+    </testsuites>
     <filter>
         <whitelist addUncoveredFilesFromWhitelist="true">
             <directory suffix=".php">src/</directory>
diff --git a/tests/CredentialRepositoryTest.php b/tests/CredentialRepositoryTest.php
index 2046c70..3eb1077 100644
--- a/tests/CredentialRepositoryTest.php
+++ b/tests/CredentialRepositoryTest.php
@@ -17,12 +17,10 @@ public function testHas()
         $this->assertFalse($repo->has('barbaz'));
     }
 
-    /**
-     * @expectedException InvalidArgumentException
-     * @expectedExceptionMessage Given credential ID does not match any stored credentials
-     */
     public function testGetThrowsExceptionOnInvalidCredentialId()
     {
+        $this->expectException(\InvalidArgumentException::class);
+        $this->expectExceptionMessage('Given credential ID does not match any stored credentials');
         $repo = new CredentialRepository('1');
         $repo->get('non-existent');
     }
diff --git a/tests/MethodTest.php b/tests/MethodTest.php
index 2eb78d1..4c6a871 100644
--- a/tests/MethodTest.php
+++ b/tests/MethodTest.php
@@ -33,7 +33,7 @@ public function testGetRegisterHandler()
     public function testGetThumbnail()
     {
         $method = new Method();
-        $this->assertContains('images/securityKey.svg', $method->getThumbnail());
+        $this->assertStringContainsString('images/securityKey.svg', $method->getThumbnail());
     }
 
     public function testApplyRequirements()
@@ -63,6 +63,6 @@ public function testIsNotAvailableUnderHttp()
     public function testGetUnavailableMessage()
     {
         $method = new Method();
-        $this->assertContains('can only be used over HTTPS', $method->getUnavailableMessage());
+        $this->assertStringContainsString('can only be used over HTTPS', $method->getUnavailableMessage());
     }
 }
diff --git a/tests/RegisterHandlerTest.php b/tests/RegisterHandlerTest.php
index 33f8055..467d3e3 100644
--- a/tests/RegisterHandlerTest.php
+++ b/tests/RegisterHandlerTest.php
@@ -3,7 +3,7 @@
 namespace SilverStripe\WebAuthn\Tests;
 
 use Exception;
-use PHPUnit_Framework_MockObject_MockObject;
+use PHPUnit\Framework\MockObject\MockObject;
 use Psr\Log\LoggerInterface;
 use SilverStripe\Control\HTTPRequest;
 use SilverStripe\Core\Injector\Injector;
@@ -55,7 +55,7 @@ class RegisterHandlerTest extends SapphireTest
      */
     protected $originalServer;
 
-    protected function setUp()
+    protected function setUp(): void
     {
         parent::setUp();
 
@@ -77,7 +77,7 @@ protected function setUp()
         );
     }
 
-    protected function tearDown()
+    protected function tearDown(): void
     {
         $_SERVER = $this->originalServer;
 
@@ -157,7 +157,7 @@ public function testRegisterReturnsErrorWhenRequiredInformationIsMissing()
         $result = $this->handler->register($this->request, $this->store);
 
         $this->assertFalse($result->isSuccessful());
-        $this->assertContains('Incomplete data', $result->getMessage());
+        $this->assertStringContainsString('Incomplete data', $result->getMessage());
     }
 
     /**
@@ -175,7 +175,7 @@ public function testRegister(
         callable $responseValidatorMockCallback = null,
         callable $storeModifier = null
     ) {
-        /** @var RegisterHandler&PHPUnit_Framework_MockObject_MockObject $handlerMock */
+        /** @var RegisterHandler&MockObject $handlerMock */
         $handlerMock = $this->getMockBuilder(RegisterHandler::class)
             ->setMethods(['getPublicKeyCredentialLoader', 'getAuthenticatorAttestationResponseValidator'])
             ->getMock();
@@ -213,7 +213,7 @@ public function testRegister(
 
         $this->assertSame($expectedResult->isSuccessful(), $result->isSuccessful());
         if ($expectedResult->getMessage()) {
-            $this->assertContains($expectedResult->getMessage(), $result->getMessage());
+            $this->assertStringContainsString($expectedResult->getMessage(), $result->getMessage());
         }
 
         $this->assertCount(
@@ -279,18 +279,28 @@ public function registerProvider()
                 $responseMock,
                 new Result(true),
                 1,
-                function (PHPUnit_Framework_MockObject_MockObject $responseValidatorMock) {
+                function (MockObject $responseValidatorMock) {
                     // Specifically setting expectations for the result of the response validator's "check" call
-                    $responseValidatorMock->expects($this->once())->method('check')->willReturn(true);
+                    $responseValidatorMock
+                        ->expects($this->once())
+                        ->method('check')
+                        ->willReturnCallback(function (): bool {
+                            return true;
+                        });
                 },
             ],
             'valid response with existing credential' => [
                 $responseMock,
                 new Result(true),
                 1,
-                function (PHPUnit_Framework_MockObject_MockObject $responseValidatorMock) {
+                function (MockObject $responseValidatorMock) {
                     // Specifically setting expectations for the result of the response validator's "check" call
-                    $responseValidatorMock->expects($this->once())->method('check')->willReturn(true);
+                    $responseValidatorMock
+                        ->expects($this->once())
+                        ->method('check')
+                        ->willReturnCallback(function (): bool {
+                            return true;
+                        });
                 },
                 function (SessionStore $store) use ($testSource) {
                     $repo = new CredentialRepository((string) $store->getMember()->ID);
@@ -316,7 +326,7 @@ function (SessionStore $store) use ($testSource) {
                 $responseMock,
                 new Result(false, 'I am a test'),
                 0,
-                function (PHPUnit_Framework_MockObject_MockObject $responseValidatorMock) {
+                function (MockObject $responseValidatorMock) {
                     // Specifically setting expectations for the result of the response validator's "check" call
                     $responseValidatorMock->expects($this->once())->method('check')
                         ->willThrowException(new Exception('I am a test'));
diff --git a/tests/VerifyHandlerTest.php b/tests/VerifyHandlerTest.php
index 423c149..744f305 100644
--- a/tests/VerifyHandlerTest.php
+++ b/tests/VerifyHandlerTest.php
@@ -3,7 +3,7 @@
 namespace SilverStripe\WebAuthn\Tests;
 
 use Exception;
-use PHPUnit_Framework_MockObject_MockObject;
+use PHPUnit\Framework\MockObject\MockObject;
 use Psr\Log\LoggerInterface;
 use SilverStripe\Control\HTTPRequest;
 use SilverStripe\Core\Injector\Injector;
@@ -54,7 +54,7 @@ class VerifyHandlerTest extends SapphireTest
      */
     protected $mockData = [];
 
-    protected function setUp()
+    protected function setUp(): void
     {
         parent::setUp();
 
@@ -94,11 +94,9 @@ protected function setUp()
         // phpcs:enable
     }
 
-    /**
-     * @expectedException \SilverStripe\MFA\Exception\AuthenticationFailedException
-     */
     public function testStartThrowsExceptionWithMissingData()
     {
+        $this->expectException(\SilverStripe\MFA\Exception\AuthenticationFailedException::class);
         $this->registeredMethod->Data = '';
         $this->handler->start($this->store, $this->registeredMethod);
     }
@@ -115,7 +113,7 @@ public function testVerifyReturnsErrorWhenRequiredInformationIsMissing()
         $result = $this->handler->verify($this->request, $this->store, $this->registeredMethod);
 
         $this->assertFalse($result->isSuccessful());
-        $this->assertContains('Incomplete data', $result->getMessage());
+        $this->assertStringContainsString('Incomplete data', $result->getMessage());
     }
 
     /**
@@ -129,7 +127,7 @@ public function testVerify(
         $expectedResult,
         callable $responseValidatorMockCallback = null
     ) {
-        /** @var VerifyHandler&PHPUnit_Framework_MockObject_MockObject $handlerMock */
+        /** @var VerifyHandler&MockObject $handlerMock */
         $handlerMock = $this->getMockBuilder(VerifyHandler::class)
             ->setMethods(['getPublicKeyCredentialLoader', 'getAuthenticatorAssertionResponseValidator'])
             ->getMock();
@@ -162,7 +160,7 @@ public function testVerify(
 
         $this->assertSame($expectedResult->isSuccessful(), $result->isSuccessful());
         if ($expectedResult->getMessage()) {
-            $this->assertContains($expectedResult->getMessage(), $result->getMessage());
+            $this->assertStringContainsString($expectedResult->getMessage(), $result->getMessage());
         }
     }
 
@@ -183,15 +181,20 @@ public function verifyProvider()
             'valid response' => [
                 $this->createMock(AuthenticatorAssertionResponse::class),
                 new Result(true),
-                function (PHPUnit_Framework_MockObject_MockObject $responseValidatorMock) {
+                function (MockObject $responseValidatorMock) {
                     // Specifically setting expectations for the result of the response validator's "check" call
-                    $responseValidatorMock->expects($this->once())->method('check')->willReturn(true);
+                    $responseValidatorMock
+                        ->expects($this->once())
+                        ->method('check')
+                        ->willReturnCallback(function (): bool {
+                            return true;
+                        });
                 },
             ],
             'invalid response' => [
                 $this->createMock(AuthenticatorAssertionResponse::class),
                 new Result(false, 'I am a test'),
-                function (PHPUnit_Framework_MockObject_MockObject $responseValidatorMock) {
+                function (MockObject $responseValidatorMock) {
                     // Specifically setting expectations for the result of the response validator's "check" call
                     $responseValidatorMock->expects($this->once())->method('check')
                         ->willThrowException(new Exception('I am a test'));