diff --git a/src/OpenIddict.Core/OpenIddictCoreBuilder.cs b/src/OpenIddict.Core/OpenIddictCoreBuilder.cs
index 3e134f56..455fe36b 100644
--- a/src/OpenIddict.Core/OpenIddictCoreBuilder.cs
+++ b/src/OpenIddict.Core/OpenIddictCoreBuilder.cs
@@ -89,7 +89,7 @@ namespace Microsoft.Extensions.DependencyInjection
             // or closed generics (e.g OpenIddictApplicationStore<OpenIddictApplication>).
             if (type.IsGenericTypeDefinition)
             {
-                if (type.GetGenericArguments().Length != 1)
+                if (type.GetGenericArguments() is not { Length: 1 })
                 {
                     throw new ArgumentException(SR.GetResourceString(SR.ID0232), nameof(type));
                 }
@@ -145,7 +145,7 @@ namespace Microsoft.Extensions.DependencyInjection
             // or closed generics (e.g OpenIddictAuthorizationStore<OpenIddictAuthorization>).
             if (type.IsGenericTypeDefinition)
             {
-                if (type.GetGenericArguments().Length != 1)
+                if (type.GetGenericArguments() is not { Length: 1 })
                 {
                     throw new ArgumentException(SR.GetResourceString(SR.ID0232), nameof(type));
                 }
@@ -201,7 +201,7 @@ namespace Microsoft.Extensions.DependencyInjection
             // or closed generics (e.g OpenIddictScopeStore<OpenIddictScope>).
             if (type.IsGenericTypeDefinition)
             {
-                if (type.GetGenericArguments().Length != 1)
+                if (type.GetGenericArguments() is not { Length: 1 })
                 {
                     throw new ArgumentException(SR.GetResourceString(SR.ID0232), nameof(type));
                 }
@@ -257,7 +257,7 @@ namespace Microsoft.Extensions.DependencyInjection
             // or closed generics (e.g OpenIddictTokenStore<OpenIddictToken>).
             if (type.IsGenericTypeDefinition)
             {
-                if (type.GetGenericArguments().Length != 1)
+                if (type.GetGenericArguments() is not { Length: 1 })
                 {
                     throw new ArgumentException(SR.GetResourceString(SR.ID0232), nameof(type));
                 }
@@ -311,7 +311,7 @@ namespace Microsoft.Extensions.DependencyInjection
             // or closed generics (e.g OpenIddictApplicationManager<OpenIddictApplication>).
             if (type.IsGenericTypeDefinition)
             {
-                if (type.GetGenericArguments().Length != 1)
+                if (type.GetGenericArguments() is not { Length: 1 })
                 {
                     throw new ArgumentException(SR.GetResourceString(SR.ID0232), nameof(type));
                 }
@@ -405,7 +405,7 @@ namespace Microsoft.Extensions.DependencyInjection
             // or closed generics (e.g OpenIddictAuthorizationManager<OpenIddictAuthorization>).
             if (type.IsGenericTypeDefinition)
             {
-                if (type.GetGenericArguments().Length != 1)
+                if (type.GetGenericArguments() is not { Length: 1 })
                 {
                     throw new ArgumentException(SR.GetResourceString(SR.ID0232), nameof(type));
                 }
@@ -499,7 +499,7 @@ namespace Microsoft.Extensions.DependencyInjection
             // or closed generics (e.g OpenIddictScopeManager<OpenIddictScope>).
             if (type.IsGenericTypeDefinition)
             {
-                if (type.GetGenericArguments().Length != 1)
+                if (type.GetGenericArguments() is not { Length: 1 })
                 {
                     throw new ArgumentException(SR.GetResourceString(SR.ID0232), nameof(type));
                 }
@@ -593,7 +593,7 @@ namespace Microsoft.Extensions.DependencyInjection
             // or closed generics (e.g OpenIddictTokenManager<OpenIddictToken>).
             if (type.IsGenericTypeDefinition)
             {
-                if (type.GetGenericArguments().Length != 1)
+                if (type.GetGenericArguments() is not { Length: 1 })
                 {
                     throw new ArgumentException(SR.GetResourceString(SR.ID0232), nameof(type));
                 }
diff --git a/src/OpenIddict.Server/OpenIddictServerEvents.Introspection.cs b/src/OpenIddict.Server/OpenIddictServerEvents.Introspection.cs
index 6dde0816..e899e844 100644
--- a/src/OpenIddict.Server/OpenIddictServerEvents.Introspection.cs
+++ b/src/OpenIddict.Server/OpenIddictServerEvents.Introspection.cs
@@ -98,7 +98,7 @@ namespace OpenIddict.Server
             /// <summary>
             /// Gets or sets the security principal extracted from the introspected token.
             /// </summary>
-            public ClaimsPrincipal? Principal { get; set; }
+            public ClaimsPrincipal Principal { get; set; } = default!;
 
             /// <summary>
             /// Gets the additional claims returned to the caller.
diff --git a/src/OpenIddict.Server/OpenIddictServerEvents.Revocation.cs b/src/OpenIddict.Server/OpenIddictServerEvents.Revocation.cs
index 875f7093..da0e12d7 100644
--- a/src/OpenIddict.Server/OpenIddictServerEvents.Revocation.cs
+++ b/src/OpenIddict.Server/OpenIddictServerEvents.Revocation.cs
@@ -98,7 +98,7 @@ namespace OpenIddict.Server
             /// <summary>
             /// Gets or sets the security principal extracted from the revoked token.
             /// </summary>
-            public ClaimsPrincipal? Principal { get; set; }
+            public ClaimsPrincipal Principal { get; set; } = default!;
 
             /// <summary>
             /// Gets the authentication ticket.
diff --git a/src/OpenIddict.Server/OpenIddictServerEvents.Userinfo.cs b/src/OpenIddict.Server/OpenIddictServerEvents.Userinfo.cs
index 7740c7b4..9143c88c 100644
--- a/src/OpenIddict.Server/OpenIddictServerEvents.Userinfo.cs
+++ b/src/OpenIddict.Server/OpenIddictServerEvents.Userinfo.cs
@@ -93,7 +93,7 @@ namespace OpenIddict.Server
             /// <summary>
             /// Gets or sets the security principal extracted from the access token.
             /// </summary>
-            public ClaimsPrincipal? Principal { get; set; }
+            public ClaimsPrincipal Principal { get; set; } = default!;
 
             /// <summary>
             /// Gets the additional claims returned to the client application.
diff --git a/src/OpenIddict.Server/OpenIddictServerHandlers.Introspection.cs b/src/OpenIddict.Server/OpenIddictServerHandlers.Introspection.cs
index 4db4bb66..242ad2e0 100644
--- a/src/OpenIddict.Server/OpenIddictServerHandlers.Introspection.cs
+++ b/src/OpenIddict.Server/OpenIddictServerHandlers.Introspection.cs
@@ -870,6 +870,8 @@ namespace OpenIddict.Server
                         typeof(ValidateIntrospectionRequestContext).FullName!) ??
                         throw new InvalidOperationException(SR.GetResourceString(SR.ID0007));
 
+                    Debug.Assert(notification.Principal is { Identity: ClaimsIdentity }, SR.GetResourceString(SR.ID4006));
+
                     context.Principal ??= notification.Principal;
 
                     return default;
diff --git a/src/OpenIddict.Server/OpenIddictServerHandlers.Revocation.cs b/src/OpenIddict.Server/OpenIddictServerHandlers.Revocation.cs
index ba7eff0d..bbdb3519 100644
--- a/src/OpenIddict.Server/OpenIddictServerHandlers.Revocation.cs
+++ b/src/OpenIddict.Server/OpenIddictServerHandlers.Revocation.cs
@@ -813,6 +813,8 @@ namespace OpenIddict.Server
                         typeof(ValidateRevocationRequestContext).FullName!) ??
                         throw new InvalidOperationException(SR.GetResourceString(SR.ID0007));
 
+                    Debug.Assert(notification.Principal is { Identity: ClaimsIdentity }, SR.GetResourceString(SR.ID4006));
+
                     context.Principal ??= notification.Principal;
 
                     return default;
diff --git a/src/OpenIddict.Server/OpenIddictServerHandlers.Userinfo.cs b/src/OpenIddict.Server/OpenIddictServerHandlers.Userinfo.cs
index c91b9022..77e8ed2c 100644
--- a/src/OpenIddict.Server/OpenIddictServerHandlers.Userinfo.cs
+++ b/src/OpenIddict.Server/OpenIddictServerHandlers.Userinfo.cs
@@ -438,6 +438,8 @@ namespace OpenIddict.Server
                         typeof(ValidateUserinfoRequestContext).FullName!) ??
                         throw new InvalidOperationException(SR.GetResourceString(SR.ID0007));
 
+                    Debug.Assert(notification.Principal is { Identity: ClaimsIdentity }, SR.GetResourceString(SR.ID4006));
+
                     context.Principal ??= notification.Principal;
 
                     return default;
diff --git a/src/OpenIddict.Server/OpenIddictServerHandlers.cs b/src/OpenIddict.Server/OpenIddictServerHandlers.cs
index 5e855cab..7094826a 100644
--- a/src/OpenIddict.Server/OpenIddictServerHandlers.cs
+++ b/src/OpenIddict.Server/OpenIddictServerHandlers.cs
@@ -1030,7 +1030,7 @@ namespace OpenIddict.Server
                     typeof(ProcessAuthenticationContext).FullName!) ??
                     throw new InvalidOperationException(SR.GetResourceString(SR.ID0007));
 
-                Debug.Assert(notification.UserCodePrincipal is not null, SR.GetResourceString(SR.ID4006));
+                Debug.Assert(notification.UserCodePrincipal is { Identity: ClaimsIdentity }, SR.GetResourceString(SR.ID4006));
 
                 // Extract the device code identifier from the user code principal.
                 var identifier = notification.UserCodePrincipal.GetClaim(Claims.Private.DeviceCodeId);
@@ -1089,7 +1089,7 @@ namespace OpenIddict.Server
                     typeof(ProcessAuthenticationContext).FullName!) ??
                     throw new InvalidOperationException(SR.GetResourceString(SR.ID0007));
 
-                Debug.Assert(notification.UserCodePrincipal is not null, SR.GetResourceString(SR.ID4006));
+                Debug.Assert(notification.UserCodePrincipal is { Identity: ClaimsIdentity }, SR.GetResourceString(SR.ID4006));
 
                 // Extract the device code identifier from the authentication principal.
                 var identifier = notification.UserCodePrincipal.GetTokenId();
@@ -1916,7 +1916,7 @@ namespace OpenIddict.Server
                         typeof(ProcessAuthenticationContext).FullName!) ??
                         throw new InvalidOperationException(SR.GetResourceString(SR.ID0007));
 
-                    Debug.Assert(notification.RefreshTokenPrincipal is not null, SR.GetResourceString(SR.ID4006));
+                    Debug.Assert(notification.RefreshTokenPrincipal is { Identity: ClaimsIdentity }, SR.GetResourceString(SR.ID4006));
 
                     principal.SetExpirationDate(notification.RefreshTokenPrincipal.GetExpirationDate());
                 }