diff --git a/lib/internal/policy/manifest.js b/lib/internal/policy/manifest.js
index 118a89efa6f88a..e8400b672e57b0 100644
--- a/lib/internal/policy/manifest.js
+++ b/lib/internal/policy/manifest.js
@@ -76,7 +76,7 @@ class Manifest {
     const manifestEntries = entries(obj.resources);
 
     const parsedURLs = new SafeMap();
-    for (var i = 0; i < manifestEntries.length; i++) {
+    for (let i = 0; i < manifestEntries.length; i++) {
       let resourceHREF = manifestEntries[i][0];
       const originalHREF = resourceHREF;
       let resourceURL;
@@ -105,8 +105,8 @@ class Manifest {
               mismatch = true;
             } else {
               compare:
-              for (var sriI = 0; sriI < sri.length; sriI++) {
-                for (var oldI = 0; oldI < old.length; oldI++) {
+              for (let sriI = 0; sriI < sri.length; sriI++) {
+                for (let oldI = 0; oldI < old.length; oldI++) {
                   if (sri[sriI].algorithm === old[oldI].algorithm &&
                     BufferEquals(sri[sriI].value, old[oldI].value) &&
                     sri[sriI].options === old[oldI].options) {
@@ -205,7 +205,7 @@ class Manifest {
       const integrityEntries = integrities.get(href);
       if (integrityEntries === true) return true;
       // Avoid clobbered Symbol.iterator
-      for (var i = 0; i < integrityEntries.length; i++) {
+      for (let i = 0; i < integrityEntries.length; i++) {
         const {
           algorithm,
           value: expected