diff --git a/emrun.py b/emrun.py
index 145b3b2164c7e..c7827320d207f 100644
--- a/emrun.py
+++ b/emrun.py
@@ -747,7 +747,7 @@ def do_POST(self):  # # noqa: DC04
 
 # Returns stdout by running command with text=True
 def check_output(cmd, *args, **kwargs):
-  return subprocess.run(cmd, text=True, stdout=subprocess.PIPE, check=True, *args, **kwargs).stdout
+  return subprocess.run(cmd, *args, text=True, stdout=subprocess.PIPE, check=True, **kwargs).stdout
 
 
 # From http://stackoverflow.com/questions/4842448/getting-processor-information-in-python
@@ -778,9 +778,9 @@ def get_cpu_info():
     elif LINUX:
       for line in open('/proc/cpuinfo', encoding='utf-8').readlines():
         if 'model name' in line:
-          cpu_name = re.sub('.*model name.*:', '', line, count=1).strip()
+          cpu_name = re.sub(r'.*model name.*:', '', line, count=1).strip()
       lscpu = check_output(['lscpu'])
-      frequency = math.ceil(float(re.search('CPU (max )?MHz: (.*)', lscpu).group(2).strip()))
+      frequency = math.ceil(float(re.search(r'CPU (max )?MHz: (.*)', lscpu).group(2).strip()))
       sockets = int(re.search(r'Socket\(s\): (.*)', lscpu).group(1).strip())
       physical_cores = sockets * int(re.search(r'Core\(s\) per socket: (.*)', lscpu).group(1).strip())
       logical_cores = physical_cores * int(re.search(r'Thread\(s\) per core: (.*)', lscpu).group(1).strip())
@@ -889,10 +889,10 @@ def linux_get_gpu_info():
   adapterinfo = ''
   try:
     vgainfo = check_output(['lshw', '-C', 'display'], stderr=subprocess.PIPE)
-    vendor = re.search("vendor: (.*)", vgainfo).group(1).strip()
-    product = re.search("product: (.*)", vgainfo).group(1).strip()
-    description = re.search("description: (.*)", vgainfo).group(1).strip()
-    clock = re.search("clock: (.*)", vgainfo).group(1).strip()
+    vendor = re.search(r"vendor: (.*)", vgainfo).group(1).strip()
+    product = re.search(r"product: (.*)", vgainfo).group(1).strip()
+    description = re.search(r"description: (.*)", vgainfo).group(1).strip()
+    clock = re.search(r"clock: (.*)", vgainfo).group(1).strip()
     adapterinfo = vendor + ' ' + product + ', ' + description + ' (' + clock + ')'
   except Exception as e:
     logv(e)
@@ -918,8 +918,8 @@ def macos_get_gpu_info():
     for gpu in info:
       model_name = gpu.split('\n')[0].strip()
       if 'Bus' in gpu and 'VRAM' in gpu:
-        bus = re.search("Bus: (.*)", gpu).group(1).strip()
-        memory = int(re.search("VRAM (.*?): (.*) MB", gpu).group(2).strip())
+        bus = re.search(r"Bus: (.*)", gpu).group(1).strip()
+        memory = int(re.search(r"VRAM (.*?): (.*) MB", gpu).group(2).strip())
         gpus += [{'model': model_name + ' (' + bus + ')', 'ram': memory * 1024 * 1024}]
       else:
         gpus += [{'model': model_name, 'ram': 0}]
@@ -1053,19 +1053,19 @@ def get_computer_model():
       try:
         # http://apple.stackexchange.com/questions/98080/can-a-macs-model-year-be-determined-via-terminal-command
         serial = check_output(['system_profiler', 'SPHardwareDataType'])
-        serial = re.search("Serial Number (.*): (.*)", serial)
+        serial = re.search(r"Serial Number (.*): (.*)", serial)
         serial = serial.group(2).strip()[-4:]
         cmd = ['curl', '-s', 'http://support-sp.apple.com/sp/product?cc=' + serial]
         logv(str(cmd))
         model = check_output(cmd)
-        model = re.search('<configCode>(.*)</configCode>', model)
+        model = re.search(r'<configCode>(.*)</configCode>', model)
         model = model.group(1).strip()
         with open(os.path.join(os.getenv("HOME"), '.emrun.hwmodel.cached'), 'w', encoding='utf-8') as fh:
           fh.write(model) # Cache the hardware model to disk
         return model
       except Exception:
         hwmodel = check_output(['sysctl', 'hw.model'])
-        hwmodel = re.search('hw.model: (.*)', hwmodel).group(1).strip()
+        hwmodel = re.search(r'hw.model: (.*)', hwmodel).group(1).strip()
         return hwmodel
     elif WINDOWS:
       manufacturer = check_output(['wmic', 'baseboard', 'get', 'manufacturer']).split('\n')[1].strip()
diff --git a/pyproject.toml b/pyproject.toml
index 8cbce9634f067..1f765bfbf8285 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -51,11 +51,9 @@ lint.ignore = [
   "non-imperative-mood",
   "assert-false", # See https://github.com/PyCQA/flake8-bugbear/issues/66
   "function-uses-loop-variable",
-  "star-arg-unpacking-after-keyword-arg",
   "module-import-not-at-top-of-file",
   "multiple-leading-hashes-for-block-comment",
   "line-too-long",
-  "ambiguous-variable-name",
   "indentation-with-invalid-multiple", # Does not honor `indent-width`. See https://github.com/astral-sh/ruff/issues/8705
   "indentation-with-invalid-multiple-comment", # Does not honor `indent-width`. See https://github.com/astral-sh/ruff/issues/8705
   "too-few-spaces-before-inline-comment",
@@ -72,8 +70,6 @@ lint.ignore = [
   "subprocess-run-without-check",
   "redefined-loop-name",
   "mutable-class-default",
-  "unnecessary-iterable-allocation-for-first-element",
-  "unraw-re-pattern",
   "non-empty-init-module",
 ]
 lint.per-file-ignores."tools/ports/*.py" = [ "unused-function-argument", "unused-lambda-argument" ]
diff --git a/test/common.py b/test/common.py
index b4f889ad29d4e..2f1de620f9fbd 100644
--- a/test/common.py
+++ b/test/common.py
@@ -391,7 +391,7 @@ def cleanup(line):
       line = '<REPLACED ENTIRE PROGRAM ON SINGLE LINE>'
     return line
 
-  lines = [cleanup(l) for l in lines]
+  lines = [cleanup(line) for line in lines]
   if not long_lines:
     # No long lines found just return the unmodified output
     return output
diff --git a/test/test_browser.py b/test/test_browser.py
index e9103d7a52da3..a85ed87878b07 100644
--- a/test/test_browser.py
+++ b/test/test_browser.py
@@ -291,7 +291,7 @@ def reftest(self, filename, reference=None, reference_slack=0, *args, **kwargs):
     kwargs['cflags'] += ['--pre-js', 'reftest.js', '-sGL_TESTING']
 
     try:
-      return self.btest(filename, expected=expected, *args, **kwargs)
+      return self.btest(filename, *args, expected=expected, **kwargs)
     finally:
       if common.EMTEST_REBASELINE and os.path.exists('actual.png'):
         print(f'overwriting expected image: {reference}')
@@ -1712,7 +1712,7 @@ def book_path(path):
     for image in images:
       cflags += ['--preload-file', f'{book_path(image)}@{os.path.basename(image)}']
 
-    libs = [l for l in libs if program in os.path.basename(l)]
+    libs = [lib for lib in libs if program in os.path.basename(lib)]
 
     self.reftest(libs[0], book_path(program.replace('.o', '.png')), cflags=cflags)
 
diff --git a/test/test_core.py b/test/test_core.py
index 99d7578a98f78..bd34c3c06bc96 100644
--- a/test/test_core.py
+++ b/test/test_core.py
@@ -3370,8 +3370,8 @@ def test_dlfcn_self(self):
     def get_data_exports(wasm):
       wat = self.get_wasm_text(wasm)
       lines = wat.splitlines()
-      exports = [l for l in lines if l.strip().startswith('(export ')]
-      data_exports = [l for l in exports if '(global ' in l]
+      exports = [line for line in lines if line.strip().startswith('(export ')]
+      data_exports = [exp for exp in exports if '(global ' in exp]
       data_exports = [d.split()[1].strip('"') for d in data_exports]
       return data_exports
 
@@ -8002,7 +8002,7 @@ def test_source_map(self):
     # can do an apples-to-apples comparison by compiling with the same file name
     shutil.move(out_filename, no_maps_filename)
     no_maps_file = read_file(no_maps_filename)
-    no_maps_file = re.sub(' *//[@#].*$', '', no_maps_file, flags=re.MULTILINE)
+    no_maps_file = re.sub(r' *//[@#].*$', '', no_maps_file, flags=re.MULTILINE)
     self.cflags.append('-gsource-map')
 
     self.emcc(os.path.abspath('src.cpp'), ['-o', out_filename])
diff --git a/test/test_other.py b/test/test_other.py
index a0403d697c507..8a8dd52efe2bb 100644
--- a/test/test_other.py
+++ b/test/test_other.py
@@ -4033,7 +4033,7 @@ def check(text):
 
     def clean(txt):
       lines = txt.splitlines()
-      lines = [l for l in lines if 'PACKAGE_UUID' not in l and 'loadPackage({' not in l]
+      lines = [line for line in lines if 'PACKAGE_UUID' not in line and 'loadPackage({' not in line]
       return ''.join(lines)
 
     self.assertTextDataIdentical(clean(proc.stdout), clean(proc2.stdout))
@@ -8512,7 +8512,7 @@ def test_memory_size(self):
       print(' '.join(cmd))
       self.run_process(cmd)
       wat = self.get_wasm_text('a.out.wasm')
-      memories = [l for l in wat.splitlines() if '(memory ' in l]
+      memories = [line for line in wat.splitlines() if '(memory ' in line]
       self.assertEqual(len(memories), 2)
       line = memories[0]
       parts = line.strip().replace('(', '').replace(')', '').split()
@@ -11187,7 +11187,7 @@ def test_emscripten_license(self, expect_license, args):
     # fastcomp does not support the new license flag
     self.run_process([EMCC, test_file('hello_world.c')] + args)
     js = read_file('a.out.js')
-    licenses_found = len(re.findall('Copyright [0-9]* The Emscripten Authors', js))
+    licenses_found = len(re.findall(r'Copyright [0-9]* The Emscripten Authors', js))
     if expect_license:
       self.assertNotEqual(licenses_found, 0, 'Unable to find license block in output file!')
       self.assertEqual(licenses_found, 1, 'Found too many license blocks in the output file!')
diff --git a/test/test_sanity.py b/test/test_sanity.py
index e599eca77e08f..b4d88b3ed3f51 100644
--- a/test/test_sanity.py
+++ b/test/test_sanity.py
@@ -221,11 +221,11 @@ def make_new_executable(name):
     self.assertContained('NODE_JS', output)
     if not utils.WINDOWS:
       # os.chmod can't make files executable on Windows
-      self.assertIdentical(temp_bin, re.search("^ *LLVM_ROOT *= (.*)$", output, re.M).group(1))
+      self.assertIdentical(temp_bin, re.search(r"^ *LLVM_ROOT *= (.*)$", output, re.M).group(1))
       possible_nodes = [os.path.join(temp_bin, 'node')]
       if os.path.exists('/usr/bin/nodejs'):
         possible_nodes.append('/usr/bin/nodejs')
-      self.assertIdentical(possible_nodes, re.search("^ *NODE_JS *= (.*)$", output, re.M).group(1))
+      self.assertIdentical(possible_nodes, re.search(r"^ *NODE_JS *= (.*)$", output, re.M).group(1))
 
     template_data = utils.read_file(path_from_root('tools/config_template.py'))
     self.assertNotContained('{{{', config_data)
diff --git a/tools/building.py b/tools/building.py
index 9558582ebdb85..4a4a466ac8915 100644
--- a/tools/building.py
+++ b/tools/building.py
@@ -1313,7 +1313,7 @@ def run_wasm_bindgen(infile):
   # Don't try to predict the .wasm filename that wasm-bindgen outputs. Instead
   # just grab the .wasm file itself.
   all_output_files = os.listdir(bindgen_out_dir)
-  new_wasm_file = [x for x in all_output_files if x.endswith('.wasm')][0]
+  new_wasm_file = next(x for x in all_output_files if x.endswith('.wasm'))
   new_wasm_path = os.path.join(bindgen_out_dir, new_wasm_file)
 
   exports_after = {e.name for e in webassembly.get_exports(new_wasm_path)}
diff --git a/tools/cmdline.py b/tools/cmdline.py
index 42a30d848729f..babcd7142a047 100644
--- a/tools/cmdline.py
+++ b/tools/cmdline.py
@@ -272,8 +272,8 @@ def consume_arg_file():
       diagnostics.warning('deprecated', f'{arg} is no longer supported')
       continue
 
-    for l in LEGACY_ARGS:
-      if check_arg(l):
+    for legacy_arg in LEGACY_ARGS:
+      if check_arg(legacy_arg):
         consume_arg()
         diagnostics.warning('deprecated', f'{arg} is no longer supported')
         continue
diff --git a/tools/emsymbolizer.py b/tools/emsymbolizer.py
index 4b1dc1a3308d1..0a71b24554d72 100755
--- a/tools/emsymbolizer.py
+++ b/tools/emsymbolizer.py
@@ -268,8 +268,8 @@ def main(args):
 
     def print_loc(loc):
       if isinstance(loc, list):
-        for l in loc:
-          l.print()
+        for item in loc:
+          item.print()
       else:
         loc.print()
 
diff --git a/tools/gen_struct_info.py b/tools/gen_struct_info.py
index b7ecc838f4169..47e15ca91291c 100755
--- a/tools/gen_struct_info.py
+++ b/tools/gen_struct_info.py
@@ -162,7 +162,7 @@ def gen_inspect_code(self, path: list[str], struct: list[str | dict]):
       for field in struct:
         if isinstance(field, dict):
           # We have to recurse to inspect the nested dict.
-          fname = list(field.keys())[0]
+          fname = next(iter(field.keys()))
           self.gen_inspect_code([*path, fname], field[fname])
         else:
           member = ".".join([*path[1:], field])
diff --git a/tools/link.py b/tools/link.py
index 71667330ab910..68030446ed58b 100644
--- a/tools/link.py
+++ b/tools/link.py
@@ -2735,8 +2735,8 @@ def process_libraries(flags):
 
     js_libs = map_to_js_libs(lib)
     if js_libs is not None:
-      for l in js_libs:
-        add_system_js_lib(l)
+      for js_lib in js_libs:
+        add_system_js_lib(js_lib)
 
     # We don't need to resolve system libraries to absolute paths here, we can just
     # let wasm-ld handle that.  However, we do want to map to the correct variant.
diff --git a/tools/maint/gen_sig_info.py b/tools/maint/gen_sig_info.py
index 85e9611f03920..f9b005b55e2a3 100755
--- a/tools/maint/gen_sig_info.py
+++ b/tools/maint/gen_sig_info.py
@@ -247,19 +247,19 @@ def write_sig_library(filename, sig_info):
 def update_sigs(sig_info):
   print("updating __sig attributes ...")
 
-  def update_line(l):
-    if '__sig' not in l:
-      return l
-    stripped = l.strip()
+  def update_line(line):
+    if '__sig' not in line:
+      return line
+    stripped = line.strip()
     for sym, sig in sig_info.items():
       if stripped.startswith(f'{sym}__sig:'):
-        return re.sub(rf"\b{sym}__sig: '.*'", f"{sym}__sig: '{sig}'", l)
-    return l
+        return re.sub(rf"\b{sym}__sig: '.*'", f"{sym}__sig: '{sig}'", line)
+    return line
 
   files = glob.glob('src/*.js') + glob.glob('src/**/*.js')
   for file in files:
     lines = utils.read_file(file).splitlines()
-    lines = [update_line(l) for l in lines]
+    lines = [update_line(line) for line in lines]
     utils.write_file(file, '\n'.join(lines) + '\n')
 
 
@@ -268,15 +268,15 @@ def remove_sigs(sig_info):
 
   to_remove = [f'{sym}__sig:' for sym in sig_info]
 
-  def strip_line(l):
-    l = l.strip()
-    return l.startswith(to_remove)
+  def strip_line(line):
+    line = line.strip()
+    return line.startswith(to_remove)
 
   files = glob.glob('src/*.js') + glob.glob('src/**/*.js')
   for file in files:
     if os.path.basename(file) != 'libsigs.js':
       lines = utils.read_file(file).splitlines()
-      lines = [l for l in lines if not strip_line(l)]
+      lines = [line for line in lines if not strip_line(line)]
       utils.write_file(file, '\n'.join(lines) + '\n')
 
 
diff --git a/tools/maint/rebaseline_tests.py b/tools/maint/rebaseline_tests.py
index 1ba421325ddad..f77fe2b35c482 100755
--- a/tools/maint/rebaseline_tests.py
+++ b/tools/maint/rebaseline_tests.py
@@ -39,7 +39,7 @@ def read_size_from_json(content):
     return json_data['total']
   # If `total` if not in the json dict then just use the first key.  This happens when only one
   # file size is reported (in this case we don't calculate or store the `total`).
-  first_key = list(json_data.keys())[0]
+  first_key = next(iter(json_data.keys()))
   return json_data[first_key]
 
 
diff --git a/tools/utils.py b/tools/utils.py
index 56af327313fbf..b6e2f54f0adf6 100644
--- a/tools/utils.py
+++ b/tools/utils.py
@@ -43,7 +43,7 @@ def run_process(cmd, check=True, input=None, *args, **kw):
   kw.setdefault('text', True)
   if kw['text']:
     kw.setdefault('encoding', 'utf-8')
-  ret = subprocess.run(cmd, check=check, input=input, *args, **kw)
+  ret = subprocess.run(cmd, *args, check=check, input=input, **kw)
   debug_text = f"{'successfully ' if check else ''}executed {shlex.join(cmd)}"
   logger.debug(debug_text)
   return ret