diff --git a/Library/Homebrew/os/mac/keg.rb b/Library/Homebrew/os/mac/keg.rb
index 127633ee87..ebe0f17d7f 100644
--- a/Library/Homebrew/os/mac/keg.rb
+++ b/Library/Homebrew/os/mac/keg.rb
@@ -1,7 +1,14 @@
-# typed: true # rubocop:todo Sorbet/StrictSigil
+# typed: strict
 # frozen_string_literal: true
 
 class Keg
+  sig { params(path: Pathname).void }
+  def initialize(path)
+    super
+
+    @require_relocation = T.let(false, T::Boolean)
+  end
+
   sig { params(id: String, file: Pathname).returns(T::Boolean) }
   def change_dylib_id(id, file)
     return false if file.dylib_id == id
@@ -36,6 +43,7 @@ class Keg
     raise
   end
 
+  sig { params(old: String, new: String, file: Pathname).returns(T::Boolean) }
   def change_rpath(old, new, file)
     return false if old == new
 
diff --git a/Library/Homebrew/os/mac/mach.rb b/Library/Homebrew/os/mac/mach.rb
index 44ddf94636..5a0a27566a 100644
--- a/Library/Homebrew/os/mac/mach.rb
+++ b/Library/Homebrew/os/mac/mach.rb
@@ -1,4 +1,4 @@
-# typed: true # rubocop:todo Sorbet/StrictSigil
+# typed: strict
 # frozen_string_literal: true
 
 require "macho"
@@ -12,25 +12,28 @@ module MachOShim
 
   delegate [:dylib_id] => :macho
 
+  sig { params(args: T.untyped).void }
   def initialize(*args)
-    @macho = T.let(nil, T.nilable(MachO::MachOFile))
-    @mach_data = T.let(nil, T.nilable(T::Array[T::Hash[Symbol, T.untyped]]))
+    @macho = T.let(nil, T.nilable(T.any(MachO::MachOFile, MachO::FatFile)))
+    @mach_data = T.let(nil, T.nilable(T::Array[T::Hash[Symbol, Symbol]]))
 
     super
   end
 
+  sig { returns(T.any(MachO::MachOFile, MachO::FatFile)) }
   def macho
     @macho ||= MachO.open(to_s)
   end
   private :macho
 
-  sig { returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+  sig { returns(T::Array[T::Hash[Symbol, Symbol]]) }
   def mach_data
     @mach_data ||= begin
       machos = []
       mach_data = []
 
-      if MachO::Utils.fat_magic?(macho.magic)
+      case (macho = self.macho)
+      when MachO::FatFile
         machos = macho.machos
       else
         machos << macho
@@ -68,34 +71,38 @@ module MachOShim
 
   # TODO: See if the `#write!` call can be delayed until
   #       we know we're not making any changes to the rpaths.
-  def delete_rpath(rpath, **options)
+  sig { params(rpath: String, strict: T::Boolean).void }
+  def delete_rpath(rpath, strict: true)
     candidates = rpaths(resolve_variable_references: false).select do |r|
       resolve_variable_name(r) == resolve_variable_name(rpath)
     end
 
     # Delete the last instance to avoid changing the order in which rpaths are searched.
     rpath_to_delete = candidates.last
-    options[:last] = true
 
-    macho.delete_rpath(rpath_to_delete, options)
+    macho.delete_rpath(rpath_to_delete, { last: true, strict: })
     macho.write!
   end
 
-  def change_rpath(old, new, **options)
-    macho.change_rpath(old, new, options)
+  sig { params(old: String, new: String, uniq: T::Boolean, last: T::Boolean, strict: T::Boolean).void }
+  def change_rpath(old, new, uniq: false, last: false, strict: true)
+    macho.change_rpath(old, new, { uniq:, last:, strict: })
     macho.write!
   end
 
-  def change_dylib_id(id, **options)
-    macho.change_dylib_id(id, options)
+  sig { params(id: String, strict: T::Boolean).void }
+  def change_dylib_id(id, strict: true)
+    macho.change_dylib_id(id, { strict: })
     macho.write!
   end
 
-  def change_install_name(old, new, **options)
-    macho.change_install_name(old, new, options)
+  sig { params(old: String, new: String, strict: T::Boolean).void }
+  def change_install_name(old, new, strict: true)
+    macho.change_install_name(old, new, { strict: })
     macho.write!
   end
 
+  sig { params(except: Symbol, resolve_variable_references: T::Boolean).returns(T::Array[String]) }
   def dynamically_linked_libraries(except: :none, resolve_variable_references: true)
     lcs = macho.dylib_load_commands
     lcs.reject! { |lc| lc.flag?(except) } if except != :none
@@ -105,6 +112,7 @@ module MachOShim
     names
   end
 
+  sig { params(resolve_variable_references: T::Boolean).returns(T::Array[String]) }
   def rpaths(resolve_variable_references: true)
     names = macho.rpaths
     # Don't recursively resolve rpaths to avoid infinite loops.
@@ -113,11 +121,12 @@ module MachOShim
     names
   end
 
+  sig { params(name: String, resolve_rpaths: T::Boolean).returns(String) }
   def resolve_variable_name(name, resolve_rpaths: true)
     if name.start_with? "@loader_path"
-      Pathname(name.sub("@loader_path", dirname)).cleanpath.to_s
+      Pathname(name.sub("@loader_path", dirname.to_s)).cleanpath.to_s
     elsif name.start_with?("@executable_path") && binary_executable?
-      Pathname(name.sub("@executable_path", dirname)).cleanpath.to_s
+      Pathname(name.sub("@executable_path", dirname.to_s)).cleanpath.to_s
     elsif resolve_rpaths && name.start_with?("@rpath") && (target = resolve_rpath(name)).present?
       target
     else
@@ -125,6 +134,7 @@ module MachOShim
     end
   end
 
+  sig { params(name: String).returns(T.nilable(String)) }
   def resolve_rpath(name)
     target = T.let(nil, T.nilable(String))
     return unless rpaths(resolve_variable_references: true).find do |rpath|
@@ -134,48 +144,58 @@ module MachOShim
     target
   end
 
+  sig { returns(T::Array[Symbol]) }
   def archs
     mach_data.map { |m| m.fetch :arch }
   end
 
+  sig { returns(Symbol) }
   def arch
     case archs.length
     when 0 then :dunno
-    when 1 then archs.first
+    when 1 then archs.fetch(0)
     else :universal
     end
   end
 
+  sig { returns(T::Boolean) }
   def universal?
     arch == :universal
   end
 
+  sig { returns(T::Boolean) }
   def i386?
     arch == :i386
   end
 
+  sig { returns(T::Boolean) }
   def x86_64?
     arch == :x86_64
   end
 
+  sig { returns(T::Boolean) }
   def ppc7400?
     arch == :ppc7400
   end
 
+  sig { returns(T::Boolean) }
   def ppc64?
     arch == :ppc64
   end
 
+  sig { returns(T::Boolean) }
   def dylib?
     mach_data.any? { |m| m.fetch(:type) == :dylib }
   end
 
+  sig { returns(T::Boolean) }
   def mach_o_executable?
     mach_data.any? { |m| m.fetch(:type) == :executable }
   end
 
   alias binary_executable? mach_o_executable?
 
+  sig { returns(T::Boolean) }
   def mach_o_bundle?
     mach_data.any? { |m| m.fetch(:type) == :bundle }
   end
diff --git a/Library/Homebrew/os/mac/sdk.rb b/Library/Homebrew/os/mac/sdk.rb
index 1584941c99..498fd8e3bb 100644
--- a/Library/Homebrew/os/mac/sdk.rb
+++ b/Library/Homebrew/os/mac/sdk.rb
@@ -1,4 +1,4 @@
-# typed: true # rubocop:todo Sorbet/StrictSigil
+# typed: strict
 # frozen_string_literal: true
 
 require "system_command"
@@ -22,7 +22,7 @@ module OS
       sig { params(version: MacOSVersion, path: T.any(String, Pathname), source: Symbol).void }
       def initialize(version, path, source)
         @version = version
-        @path = Pathname.new(path)
+        @path = T.let(Pathname(path), Pathname)
         @source = source
       end
     end
@@ -36,6 +36,12 @@ module OS
 
       class NoSDKError < StandardError; end
 
+      sig { void }
+      def initialize
+        @all_sdks = T.let(nil, T.nilable(T::Array[SDK]))
+        @sdk_prefix = T.let(nil, T.nilable(String))
+      end
+
       sig { params(version: MacOSVersion).returns(SDK) }
       def sdk_for(version)
         sdk = all_sdks.find { |s| s.version == version }
diff --git a/Library/Homebrew/os/mac/xcode.rb b/Library/Homebrew/os/mac/xcode.rb
index a733a31993..4ec04e7d2d 100644
--- a/Library/Homebrew/os/mac/xcode.rb
+++ b/Library/Homebrew/os/mac/xcode.rb
@@ -1,11 +1,11 @@
-# typed: true # rubocop:todo Sorbet/StrictSigil
+# typed: strict
 # frozen_string_literal: true
 
 module OS
   module Mac
     # Helper module for querying Xcode information.
     module Xcode
-      DEFAULT_BUNDLE_PATH = Pathname("/Applications/Xcode.app").freeze
+      DEFAULT_BUNDLE_PATH = T.let(Pathname("/Applications/Xcode.app").freeze, Pathname)
       BUNDLE_ID = "com.apple.dt.Xcode"
       OLD_BUNDLE_ID = "com.apple.Xcode"
       APPLE_DEVELOPER_DOWNLOAD_URL = "https://developer.apple.com/download/all/"
@@ -98,7 +98,7 @@ module OS
       # directory or nil if Xcode.app is not installed.
       sig { returns(T.nilable(Pathname)) }
       def self.prefix
-        @prefix ||= begin
+        @prefix ||= T.let(begin
           dir = MacOS.active_developer_dir
 
           if dir.empty? || dir == CLT::PKG_PATH || !File.directory?(dir)
@@ -108,7 +108,7 @@ module OS
             # Use cleanpath to avoid pathological trailing slash
             Pathname.new(dir).cleanpath
           end
-        end
+        end, T.nilable(Pathname))
       end
 
       sig { returns(Pathname) }
@@ -134,7 +134,7 @@ module OS
 
       sig { returns(XcodeSDKLocator) }
       def self.sdk_locator
-        @sdk_locator ||= XcodeSDKLocator.new
+        @sdk_locator ||= T.let(XcodeSDKLocator.new, T.nilable(OS::Mac::XcodeSDKLocator))
       end
 
       sig { params(version: T.nilable(MacOSVersion)).returns(T.nilable(SDK)) }
@@ -183,7 +183,7 @@ module OS
         # may return a version string
         # that is guessed based on the compiler, so do not
         # use it in order to check if Xcode is installed.
-        if @version ||= detect_version
+        if @version ||= T.let(detect_version, T.nilable(String))
           ::Version.new @version
         else
           ::Version::NULL
@@ -293,7 +293,7 @@ module OS
 
       sig { returns(CLTSDKLocator) }
       def self.sdk_locator
-        @sdk_locator ||= CLTSDKLocator.new
+        @sdk_locator ||= T.let(CLTSDKLocator.new, T.nilable(OS::Mac::CLTSDKLocator))
       end
 
       sig { params(version: T.nilable(MacOSVersion)).returns(T.nilable(SDK)) }
@@ -444,7 +444,7 @@ module OS
       # @api internal
       sig { returns(::Version) }
       def self.version
-        if @version ||= detect_version
+        if @version ||= T.let(detect_version, T.nilable(String))
           ::Version.new @version
         else
           ::Version::NULL