diff --git a/eslint.config.mjs b/eslint.config.mjs
index e1eeb2f8ed0..b20b237f5f4 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -389,4 +389,11 @@ export default [
             "mongodb/no-tojson-fn": 0,
         },
     },
+    {
+        // Shell-specific: extra strict!
+        files: ["jstests/core/js/**", "jstests/noPassthrough/shell/**"],
+        rules: {
+            "no-var": 2,
+        },
+    },
 ];
diff --git a/jstests/core/js/map1.js b/jstests/core/js/map1.js
index b1641e96930..160aa48d300 100644
--- a/jstests/core/js/map1.js
+++ b/jstests/core/js/map1.js
@@ -1,9 +1,9 @@
 
 function basic1(key, lookup, shouldFail) {
-    var m = new BSONAwareMap();
+    let m = new BSONAwareMap();
     m.put(key, 17);
 
-    var out = m.get(lookup || key);
+    let out = m.get(lookup || key);
 
     if (!shouldFail) {
         assert.eq(17, out, "basic1 missing: " + tojson(key));
diff --git a/jstests/noPassthrough/shell/launcher_test.js b/jstests/noPassthrough/shell/launcher_test.js
index 6cc26ca3d26..7f2f1e780ef 100644
--- a/jstests/noPassthrough/shell/launcher_test.js
+++ b/jstests/noPassthrough/shell/launcher_test.js
@@ -5,13 +5,13 @@
 const numLines = 300;
 const lineContents = "lots of super fun text\n".repeat(numLines).trim();
 
-var echoTest = function() {
+let echoTest = function() {
     clearRawMongoProgramOutput();
 
     // This will produce `numLines` + 1 lines of output because echo isn't being called with
     // `-n`. This will block until the program exits.
-    var exitCode = runProgram("echo", lineContents);
-    var output = rawMongoProgramOutput(".*");
+    let exitCode = runProgram("echo", lineContents);
+    let output = rawMongoProgramOutput(".*");
 
     assert.eq(0, exitCode);
 
@@ -22,6 +22,6 @@ var echoTest = function() {
 
 // The motivating failure for the test was a race in runProgram. Empirically, 10 runs has always
 // been sufficient for this to fail. 16 gives the test some leeway.
-for (var i = 0; i < 16; i++) {
+for (let i = 0; i < 16; i++) {
     echoTest();
 }
\ No newline at end of file
diff --git a/jstests/noPassthrough/shell/parallel_shell_must_assert.js b/jstests/noPassthrough/shell/parallel_shell_must_assert.js
index 056c2666d6b..10544eca718 100644
--- a/jstests/noPassthrough/shell/parallel_shell_must_assert.js
+++ b/jstests/noPassthrough/shell/parallel_shell_must_assert.js
@@ -1,10 +1,10 @@
 function tryParallelShell() {
-    var nevercalled = startParallelShell("");
+    let nevercalled = startParallelShell("");
     // The shell running this function will generate a non-zero exit code
     // because nevercalled isn't called.
 }
 
-var ret = startParallelShell(tryParallelShell);
+let ret = startParallelShell(tryParallelShell);
 
 assert.throws(ret);
 // Since ret is called by assert.throws, the shell running this file will
diff --git a/jstests/noPassthrough/shell/shell_assertions.js b/jstests/noPassthrough/shell/shell_assertions.js
index 7857bd04f0f..04509cd708a 100644
--- a/jstests/noPassthrough/shell/shell_assertions.js
+++ b/jstests/noPassthrough/shell/shell_assertions.js
@@ -155,7 +155,7 @@ tests.push(function assertShouldThrowExceptionForFalseWithDefaultMessagePrefix()
 });
 
 tests.push(function assertShouldNotCallMsgFunctionsOnSuccess() {
-    var called = false;
+    let called = false;
 
     assert(true, () => {
         called = true;
@@ -165,7 +165,7 @@ tests.push(function assertShouldNotCallMsgFunctionsOnSuccess() {
 });
 
 tests.push(function assertShouldCallMsgFunctionsOnFailure() {
-    var called = false;
+    let called = false;
 
     assert.throws(() => {
         assert(false, () => {
@@ -211,7 +211,7 @@ tests.push(function eqShouldFailWhenNotEqual() {
 });
 
 tests.push(function eqShouldNotCallMsgFunctionOnSuccess() {
-    var called = false;
+    let called = false;
 
     assert.doesNotThrow(() => {
         assert.eq(3, 3, () => {
@@ -223,7 +223,7 @@ tests.push(function eqShouldNotCallMsgFunctionOnSuccess() {
 });
 
 tests.push(function eqShouldCallMsgFunctionOnFailure() {
-    var called = false;
+    let called = false;
 
     assert.throws(() => {
         assert.eq(1, 3, () => {
@@ -335,7 +335,7 @@ tests.push(function soonFailsIfMethodNeverPasses() {
 });
 
 tests.push(function soonPassesIfMethodEventuallyPasses() {
-    var count = 0;
+    let count = 0;
     assert.doesNotThrow(() => {
         assert.soon(() => {
             count += 1;
@@ -347,7 +347,7 @@ tests.push(function soonPassesIfMethodEventuallyPasses() {
 /* assert.soonNoExcept tests */
 
 tests.push(function soonNoExceptEventuallyPassesEvenWithExceptions() {
-    var count = 0;
+    let count = 0;
     assert.doesNotThrow(() => {
         assert.soonNoExcept(() => {
             count += 1;
@@ -360,7 +360,7 @@ tests.push(function soonNoExceptEventuallyPassesEvenWithExceptions() {
 });
 
 tests.push(function soonNoExceptFailsIfExceptionAlwaysThrown() {
-    var count = 0;
+    let count = 0;
     assert.throws(() => {
         assert.soonNoExcept(() => {
             throw new Error('failed');
@@ -371,7 +371,7 @@ tests.push(function soonNoExceptFailsIfExceptionAlwaysThrown() {
 /* assert.retry tests */
 
 tests.push(function retryPassesAfterAFewAttempts() {
-    var count = 0;
+    let count = 0;
 
     assert.doesNotThrow(() => {
         assert.retry(() => {
@@ -394,7 +394,7 @@ tests.push(function retryFailsAfterMaxAttempts() {
 /* assert.retryNoExcept tests */
 
 tests.push(function retryNoExceptPassesAfterAFewAttempts() {
-    var count = 0;
+    let count = 0;
 
     assert.doesNotThrow(() => {
         assert.retryNoExcept(() => {
diff --git a/jstests/noPassthrough/shell/shell_cmd_assertions.js b/jstests/noPassthrough/shell/shell_cmd_assertions.js
index 50cb9ffc2c1..4060454d394 100644
--- a/jstests/noPassthrough/shell/shell_cmd_assertions.js
+++ b/jstests/noPassthrough/shell/shell_cmd_assertions.js
@@ -39,8 +39,8 @@ tests.push(function rawCommandOk() {
 
 function _assertMsgFunctionExecution(
     assertFunc, assertParameter, {expectException: expectException = false} = {}) {
-    var msgFunctionCalled = false;
-    var expectedAssert = assert.doesNotThrow;
+    let msgFunctionCalled = false;
+    let expectedAssert = assert.doesNotThrow;
 
     if (expectException) {
         expectedAssert = assert.throws;
@@ -63,7 +63,7 @@ tests.push(function msgFunctionOnlyCalledOnFailure() {
         assert.commandWorkedIgnoringWriteErrors, res, {expectException: false});
     _assertMsgFunctionExecution(assert.commandFailed, res, {expectException: true});
 
-    var msgFunctionCalled = false;
+    let msgFunctionCalled = false;
     assert.throws(() => assert.commandFailedWithCode(res, 0, () => {
         msgFunctionCalled = true;
     }));
diff --git a/jstests/noPassthrough/shell/shell_helper_use_database.js b/jstests/noPassthrough/shell/shell_helper_use_database.js
index c00a04e63c4..4da8d407fc5 100644
--- a/jstests/noPassthrough/shell/shell_helper_use_database.js
+++ b/jstests/noPassthrough/shell/shell_helper_use_database.js
@@ -4,7 +4,7 @@
 
 // We explicitly declare the global 'db' object since the rest of the test runs with strict-mode
 // enabled.
-var db;
+var db;  // eslint-disable-line no-var
 
 const conn = MongoRunner.runMongod({});
 assert.neq(null, conn, "mongod was unable to start up");
diff --git a/jstests/noPassthrough/shell/shell_history.js b/jstests/noPassthrough/shell/shell_history.js
index 9b8eb66cec6..2efbab3949e 100644
--- a/jstests/noPassthrough/shell/shell_history.js
+++ b/jstests/noPassthrough/shell/shell_history.js
@@ -2,15 +2,15 @@
 // appropriate permissions (where relevant).
 
 // Use dataPath because it includes the trailing "/" or "\".
-var tmpHome = MongoRunner.dataPath;
+let tmpHome = MongoRunner.dataPath;
 // Ensure it exists and is a dir (eg. if running without resmoke.py and /data/db doesn't exist).
 mkdir(tmpHome);
 removeFile(tmpHome + ".dbshell");
 
-var args = [];
-var cmdline = "mongo --nodb";
-var redirection = "";
-var env = {};
+let args = [];
+let cmdline = "mongo --nodb";
+let redirection = "";
+let env = {};
 if (_isWindows()) {
     args.push("cmd.exe");
     args.push("/c");
@@ -23,14 +23,15 @@ if (_isWindows()) {
     // USERPROFILE set to the tmp homedir.
     // Since NUL is a character device, isatty() will return true, which means that .mongorc.js
     // will be created in the HOMEDRIVE + HOMEPATH location, so we must set them also.
+    let tmpHomeDrive, tmpHomePath;
     if (tmpHome.match("^[a-zA-Z]:")) {
-        var tmpHomeDrive = tmpHome.substr(0, 2);
-        var tmpHomePath = tmpHome.substr(2);
+        tmpHomeDrive = tmpHome.substr(0, 2);
+        tmpHomePath = tmpHome.substr(2);
     } else {
-        var _pwd = pwd();
+        let _pwd = pwd();
         assert(_pwd.match("^[a-zA-Z]:"), "pwd must include drive");
-        var tmpHomeDrive = _pwd.substr(0, 2);
-        var tmpHomePath = tmpHome;
+        tmpHomeDrive = _pwd.substr(0, 2);
+        tmpHomePath = tmpHome;
     }
     env = {USERPROFILE: tmpHome, HOMEDRIVE: tmpHomeDrive, HOMEPATH: tmpHomePath};
 
@@ -60,16 +61,16 @@ if (_isWindows()) {
 cmdline += " " + redirection;
 args.push(cmdline);
 jsTestLog("Running args:\n    " + tojson(args) + "\nwith env:\n    " + tojson(env));
-var pid = _startMongoProgram({args, env});
-var rc = waitProgram(pid);
+let pid = _startMongoProgram({args, env});
+let rc = waitProgram(pid);
 
 assert.eq(rc, 0);
 
-var files = listFiles(tmpHome);
+let files = listFiles(tmpHome);
 jsTestLog(tojson(files));
 
-var findFile = function(baseName) {
-    for (var i = 0; i < files.length; i++) {
+let findFile = function(baseName) {
+    for (let i = 0; i < files.length; i++) {
         if (files[i].baseName === baseName) {
             return files[i];
         }
@@ -77,8 +78,8 @@ var findFile = function(baseName) {
     return undefined;
 };
 
-var targetFile = ".dbshell";
-var file = findFile(targetFile);
+let targetFile = ".dbshell";
+let file = findFile(targetFile);
 
 assert.neq(typeof (file), "undefined", targetFile + " should exist, but it doesn't");
 assert.eq(file.isDirectory, false, targetFile + " should not be a directory, but it is");
@@ -91,11 +92,11 @@ if (!_isWindows()) {
     // `ls -l` is POSIX, so this is the best that we have.
     // Check for exactly "-rw-------".
     clearRawMongoProgramOutput();
-    var rc = runProgram("ls", "-l", file.name);
+    let rc = runProgram("ls", "-l", file.name);
     assert.eq(rc, 0);
 
-    var output = rawMongoProgramOutput(".*");
-    var fields = output.split(" ");
+    let output = rawMongoProgramOutput(".*");
+    let fields = output.split(" ");
     // First field is the prefix, second field is the `ls -l` permissions.
     assert.eq(fields[1].substr(0, 10), "-rw-------", targetFile + " has bad permissions");
 }
diff --git a/jstests/noPassthrough/shell/shell_interactive.js b/jstests/noPassthrough/shell/shell_interactive.js
index d3c14c91aa1..db498aefe81 100644
--- a/jstests/noPassthrough/shell/shell_interactive.js
+++ b/jstests/noPassthrough/shell/shell_interactive.js
@@ -3,10 +3,10 @@
 
 if (!_isWindows()) {
     clearRawMongoProgramOutput();
-    var rc = runProgram("mongo", "--nodb", "--quiet", "--eval", "print(isInteractive())");
+    let rc = runProgram("mongo", "--nodb", "--quiet", "--eval", "print(isInteractive())");
     assert.eq(rc, 0);
-    var output = rawMongoProgramOutput(".*");
-    var response = (output.split('\n').slice(-2)[0]).split(' ')[1];
+    let output = rawMongoProgramOutput(".*");
+    let response = (output.split('\n').slice(-2)[0]).split(' ')[1];
     assert.eq(response, "false", "Expected 'false' in script mode");
     // now try interactive
     clearRawMongoProgramOutput();
diff --git a/jstests/noPassthrough/shell/shell_parallel_wait_for_pid.js b/jstests/noPassthrough/shell/shell_parallel_wait_for_pid.js
index a7afaac8506..523e84e4d29 100644
--- a/jstests/noPassthrough/shell/shell_parallel_wait_for_pid.js
+++ b/jstests/noPassthrough/shell/shell_parallel_wait_for_pid.js
@@ -6,8 +6,8 @@
 // times from the registry
 // Verify that an invariant failure doesn't occur in the program registry
 try {
-    var cleanup = startParallelShell("MongoRunner.runningChildPids();", undefined, true);
-    var cleanup2 = startParallelShell("MongoRunner.runningChildPids();", undefined, true);
+    let cleanup = startParallelShell("MongoRunner.runningChildPids();", undefined, true);
+    let cleanup2 = startParallelShell("MongoRunner.runningChildPids();", undefined, true);
     sleep(5000);
 
     try {
diff --git a/jstests/noPassthrough/shell/shell_quit.js b/jstests/noPassthrough/shell/shell_quit.js
index 945be8dbfcf..64c10066bdd 100644
--- a/jstests/noPassthrough/shell/shell_quit.js
+++ b/jstests/noPassthrough/shell/shell_quit.js
@@ -1,12 +1,12 @@
-var checkShell = function(retCode) {
-    var args = [
+let checkShell = function(retCode) {
+    let args = [
         "mongo",
         "--nodb",
         "--eval",
         "quit(" + retCode + ");",
     ];
 
-    var actualRetCode = _runMongoProgram.apply(null, args);
+    let actualRetCode = _runMongoProgram.apply(null, args);
     assert.eq(retCode, actualRetCode);
 };
 
diff --git a/jstests/noPassthrough/shell/shell_scoped_thread.js b/jstests/noPassthrough/shell/shell_scoped_thread.js
index 7cfaa126dca..0b314914df6 100644
--- a/jstests/noPassthrough/shell/shell_scoped_thread.js
+++ b/jstests/noPassthrough/shell/shell_scoped_thread.js
@@ -44,7 +44,7 @@ tests.push(function checkTestDataWithFunc() {
             // We cannot directly compare testData & TestData because the func object
             // has extra whitespace and line control.
             assert.eq(Object.keys(TestData), Object.keys(testData));
-            for (var property in TestData) {
+            for (let property in TestData) {
                 if (TestData.hasOwnProperty(property) && !(TestData.property instanceof Code)) {
                     assert.eq(TestData.property, testData.property);
                 }
diff --git a/jstests/noPassthrough/shell/shell_uses_correct_read_concern.js b/jstests/noPassthrough/shell/shell_uses_correct_read_concern.js
index 8a68d2e05cf..2be7e693b70 100644
--- a/jstests/noPassthrough/shell/shell_uses_correct_read_concern.js
+++ b/jstests/noPassthrough/shell/shell_uses_correct_read_concern.js
@@ -11,7 +11,7 @@ rst.initiate();
 const collName = "shell_uses_transaction_read_concern";
 const primary = rst.getPrimary();
 const db = primary.getDB("test");
-var coll = db.getCollection(collName);
+let coll = db.getCollection(collName);
 const testDoc = {
     "test": "doc",
     "_id": 0
diff --git a/jstests/noPassthrough/shell/shell_write_assertions.js b/jstests/noPassthrough/shell/shell_write_assertions.js
index f129ac1e830..f3cbbe82a14 100644
--- a/jstests/noPassthrough/shell/shell_write_assertions.js
+++ b/jstests/noPassthrough/shell/shell_write_assertions.js
@@ -33,7 +33,7 @@ function _doFailedWrite(collection) {
 
 /* writeOK tests */
 tests.push(function writeOKSuccessfulWriteDoesNotCallMsgFunction() {
-    var msgFunctionCalled = false;
+    let msgFunctionCalled = false;
 
     const result = db.coll.insert({data: "hello world"});
     assert.doesNotThrow(() => {
@@ -46,7 +46,7 @@ tests.push(function writeOKSuccessfulWriteDoesNotCallMsgFunction() {
 });
 
 tests.push(function writeOKUnsuccessfulWriteDoesCallMsgFunction() {
-    var msgFunctionCalled = false;
+    let msgFunctionCalled = false;
 
     const failedResult = _doFailedWrite(db.coll);
     assert.throws(() => {
@@ -60,7 +60,7 @@ tests.push(function writeOKUnsuccessfulWriteDoesCallMsgFunction() {
 
 /* writeError tests */
 tests.push(function writeErrorSuccessfulWriteDoesCallMsgFunction() {
-    var msgFunctionCalled = false;
+    let msgFunctionCalled = false;
 
     const result = db.coll.insert({data: "hello world"});
     assert.throws(() => {
@@ -73,7 +73,7 @@ tests.push(function writeErrorSuccessfulWriteDoesCallMsgFunction() {
 });
 
 tests.push(function writeErrorUnsuccessfulWriteDoesNotCallMsgFunction() {
-    var msgFunctionCalled = false;
+    let msgFunctionCalled = false;
 
     const failedResult = _doFailedWrite(db.coll);
     assert.doesNotThrow(() => {