diff --git a/js/private/js_helpers.bzl b/js/private/js_helpers.bzl
index f0dcdef07..39d22e6dd 100644
--- a/js/private/js_helpers.bzl
+++ b/js/private/js_helpers.bzl
@@ -232,7 +232,7 @@ def envs_for_log_level(log_level):
         A list of environment variables to set to turn on the js_binary runtime
         logs for the given log level. Typically, they are each set to "1".
     """
-    if log_level not in LOG_LEVELS.keys():
+    if LOG_LEVELS.get(log_level, 0) == 0:
         msg = "log_level must be one of {} but got {}".format(LOG_LEVELS.keys(), log_level)
         fail(msg)
     envs = []
diff --git a/npm/private/npm_translate_lock_generate.bzl b/npm/private/npm_translate_lock_generate.bzl
index 977c566a6..b300ab783 100644
--- a/npm/private/npm_translate_lock_generate.bzl
+++ b/npm/private/npm_translate_lock_generate.bzl
@@ -174,12 +174,12 @@ sh_binary(
                 dep_importer = paths.normalize("{}/{}".format(import_path, dep_version) if import_path else dep_version)
                 dep_path = helpers.link_package(root_package, import_path, dep_version)
                 dep_key = "{}+{}".format(dep_package, dep_path)
-                if dep_key in fp_links.keys():
+                if fp_links.get(dep_key, False):
                     fp_links[dep_key]["link_packages"][link_package] = True
                 else:
                     transitive_deps = {}
                     raw_deps = {}
-                    if dep_importer in importers.keys():
+                    if importers.get(dep_importer, False):
                         raw_deps = importers.get(dep_importer).get("deps")
                     for raw_package, raw_version in raw_deps.items():
                         package_store_name = utils.package_store_name(raw_package, raw_version)
@@ -457,7 +457,7 @@ def npm_link_all_packages(name = "node_modules", imported_links = []):
     ]
 
     for filename, contents in rctx.attr.additional_file_contents.items():
-        if not filename in rctx_files.keys():
+        if not rctx_files.get(filename, False):
             rctx_files[filename] = contents
         elif filename.endswith(".bzl"):
             # bzl files are special cased since all load statements must go at the top
diff --git a/npm/private/pnpm.bzl b/npm/private/pnpm.bzl
index 86f352619..be8072062 100644
--- a/npm/private/pnpm.bzl
+++ b/npm/private/pnpm.bzl
@@ -535,7 +535,7 @@ def _parse_lockfile(parsed, err):
 
     if not types.is_dict(parsed):
         return {}, {}, {}, "lockfile should be a starlark dict"
-    if "lockfileVersion" not in parsed.keys():
+    if not parsed.get("lockfileVersion", False):
         return {}, {}, {}, "expected lockfileVersion key in lockfile"
 
     # Lockfile version may be a float such as 5.4 or a string such as '6.0'
diff --git a/npm/private/pnpm_extension.bzl b/npm/private/pnpm_extension.bzl
index a7e5b27a7..b818b14b2 100644
--- a/npm/private/pnpm_extension.bzl
+++ b/npm/private/pnpm_extension.bzl
@@ -36,7 +36,7 @@ def resolve_pnpm_repositories(modules):
                 Only the root module may override the default name for the pnpm repository.
                 This prevents conflicting registrations in the global namespace of external repos.
                 """)
-            if attr.name not in registrations.keys():
+            if not registrations.get(attr.name, False):
                 registrations[attr.name] = []
 
             v = attr.pnpm_version
diff --git a/npm/private/utils.bzl b/npm/private/utils.bzl
index c087172bd..c836940df 100644
--- a/npm/private/utils.bzl
+++ b/npm/private/utils.bzl
@@ -197,7 +197,7 @@ def _replace_npmrc_token_envvar(token, npmrc_path, environ):
         # ${NPM_TOKEN} -> NPM_TOKEN
         # $NPM_TOKEN -> NPM_TOKEN
         token = token.removeprefix("$").removeprefix("{").removesuffix("}")
-        if token in environ.keys() and environ[token]:
+        if environ.get(token, False):
             token = environ[token]
         else:
             # buildifier: disable=print