diff --git a/app/api/fetch-ical/route.ts b/app/api/fetch-ical/route.ts
index 363dd3478..7a126a8a7 100644
--- a/app/api/fetch-ical/route.ts
+++ b/app/api/fetch-ical/route.ts
@@ -24,7 +24,7 @@ function getFetchTimeoutMs(maxBytes: number): number {
  * upstream connection is aborted rather than drained.
  */
 async function readBodyCapped(
-  response: { body: ReadableStream<Uint8Array> | null; arrayBuffer: () => Promise<ArrayBuffer> },
+  response: Pick<Response, 'body' | 'arrayBuffer'>,
   maxBytes: number,
   controller: AbortController,
 ): Promise<ArrayBuffer | null> {
@@ -39,13 +39,14 @@ async function readBodyCapped(
     const { done, value } = await reader.read();
     if (done) break;
     if (!value) continue;
-    received += value.byteLength;
+    const chunk = value as Uint8Array;
+    received += chunk.byteLength;
     if (received > maxBytes) {
       controller.abort();
       reader.cancel().catch(() => {});
       return null;
     }
-    chunks.push(value);
+    chunks.push(chunk);
   }
   const out = new Uint8Array(received);
   let offset = 0;
diff --git a/lib/calendar-invitation.ts b/lib/calendar-invitation.ts
index 3e63c7df9..a467068b4 100644
--- a/lib/calendar-invitation.ts
+++ b/lib/calendar-invitation.ts
@@ -209,7 +209,7 @@ function getOrganizerEmail(event: Partial<CalendarEvent>): string | null {
  * the bare `spf=pass` made the forged invitation look trusted.
  */
 function hasVerifiedAuthentication(email?: Pick<Email, 'from' | 'authenticationResults'>): boolean {
-  return hasAlignedAuthenticationPass(email?.authenticationResults, getPrimaryAddressEmail(email?.from));
+  return hasAlignedAuthenticationPass(email?.authenticationResults, getPrimaryAddressEmail(email?.from) ?? undefined);
 }
 
 function hasAuthenticationFailure(email?: Pick<Email, 'authenticationResults'>): boolean {