diff --git a/cylc/uiserver/handlers.py b/cylc/uiserver/handlers.py
index daa6930f..1ec87421 100644
--- a/cylc/uiserver/handlers.py
+++ b/cylc/uiserver/handlers.py
@@ -38,10 +38,11 @@
 )
 
 from cylc.uiserver.authorise import Authorization, AuthorizationMiddleware
-from cylc.uiserver.resolvers import Resolvers
 from cylc.uiserver.websockets import authenticated as websockets_authenticated
-from cylc.uiserver.websockets.tornado import TornadoSubscriptionServer
+
 if TYPE_CHECKING:
+    from cylc.uiserver.resolvers import Resolvers
+    from cylc.uiserver.websockets.tornado import TornadoSubscriptionServer
     from graphql.execution import ExecutionResult
 
 
@@ -97,7 +98,7 @@ def is_token_authenticated(handler: 'CylcAppHandler') -> bool:
     In these cases the bearer of the token is awarded full privileges.
     """
     identity_provider: JPSIdentityProvider = (
-        handler.serverapp.identity_provider
+        handler.serverapp.identity_provider  # type: ignore[union-attr]
     )
     return identity_provider.__class__ == PasswordIdentityProvider
     # NOTE: not using isinstance to narrow this down to just the one class
diff --git a/mypy.ini b/mypy.ini
index 72700dda..060c7e52 100644
--- a/mypy.ini
+++ b/mypy.ini
@@ -14,3 +14,7 @@ explicit_package_bases = True
 allow_redefinition = True
 strict_equality = True
 show_error_codes = True
+
+# Suppress the following messages:
+# By default the bodies of untyped functions are not checked, consider using --check-untyped-defs
+disable_error_code = annotation-unchecked
\ No newline at end of file
diff --git a/setup.cfg b/setup.cfg
index a0229f15..60f300d3 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -93,6 +93,7 @@ tests =
     flake8-debugger>=4.0.0
     flake8-mutable>=1.2.0
     flake8-simplify>=0.14.0
+    flake8-type-checking
     flake8>=3.0.0
     jupyter_server[test]
     mypy>=0.900