diff --git a/dev-requirements.txt b/dev-requirements.txt
index 2f2d2c10b..03642922f 100644
--- a/dev-requirements.txt
+++ b/dev-requirements.txt
@@ -6,5 +6,5 @@ httpx_ws==0.7.2  # upgrading leads to failures in tests
 pytest-random-order==1.2.0  # opt-in: --random-order --random-order-bucket=global (legacy suites are not shuffle-clean yet, see .claude/skills/gns3-api-test-writing)
 pytest-cov==7.1.0
 ruff==0.16.9
-mypy==2.3.1
+mypy==2.4.0
 rust-just==1.58.0  # provides the `just` command runner, see justfile
diff --git a/gns3server/db/models/users.py b/gns3server/db/models/users.py
index 6c74a720c..28cca8e11 100644
--- a/gns3server/db/models/users.py
+++ b/gns3server/db/models/users.py
@@ -42,7 +42,9 @@ class User(BaseTable):
     __tablename__ = "users"
 
     user_id = Column(GUID, primary_key=True, default=generate_uuid)
-    username = Column(String, unique=True, index=True)
+    # Mapped style so type checkers see `str` instead of `Column[str]`; the explicit
+    # nullable=True keeps the schema identical to the former Column(String) declaration.
+    username: Mapped[str] = mapped_column(String, unique=True, index=True, nullable=True)
     email = Column(String, unique=True, index=True)
     full_name = Column(String)
     hashed_password = Column(String)