diff --git a/common/models/acl.js b/common/models/acl.js
index 17bcc63c..922678df 100644
--- a/common/models/acl.js
+++ b/common/models/acl.js
@@ -617,7 +617,7 @@ module.exports = function(ACL) {
         break;
       default:
         // try resolving a user model with a name matching the principalType
-        var userModel = this.registry.findModel(type);
+        const userModel = this.registry.findModel(type);
         if (userModel) {
           userModel.findOne(
             {where: {or: [{username: id}, {email: id}, {id: id}]}},
diff --git a/common/models/role.js b/common/models/role.js
index 40679bfc..606dacea 100644
--- a/common/models/role.js
+++ b/common/models/role.js
@@ -133,11 +133,10 @@ module.exports = function(Role) {
       roleModel.roleMappingModel.find({
         where: {roleId: context.id, principalType: principalType},
       }, function(err, mappings) {
-        let ids;
         if (err) {
           return callback(err);
         }
-        ids = mappings.map(function(m) {
+        const ids = mappings.map(function(m) {
           return m.principalId;
         });
         query.where = query.where || {};
diff --git a/test/access-control.integration.js b/test/access-control.integration.js
index f368896e..653fd395 100644
--- a/test/access-control.integration.js
+++ b/test/access-control.integration.js
@@ -137,7 +137,7 @@ describe('access control - integration', function() {
       return '/api/users/' + this.randomUser.id;
     }
 
-    let userCounter;
+    var userCounter; // eslint-disable-line no-var
     function newUserData() {
       userCounter = userCounter ? ++userCounter : 1;
 
diff --git a/test/data-source.test.js b/test/data-source.test.js
index 18b54df0..00240566 100644
--- a/test/data-source.test.js
+++ b/test/data-source.test.js
@@ -121,7 +121,7 @@ describe('DataSource', function() {
   });
 });
 
-var assertValidDataSource = function(dataSource) {
+function assertValidDataSource(dataSource) {
   // has methods
   assert.isFunc(dataSource, 'createModel');
   assert.isFunc(dataSource, 'discoverModelDefinitions');
@@ -130,7 +130,7 @@ var assertValidDataSource = function(dataSource) {
   assert.isFunc(dataSource, 'disableRemote');
   assert.isFunc(dataSource, 'defineOperation');
   assert.isFunc(dataSource, 'operations');
-};
+}
 
 assert.isFunc = function(obj, name) {
   assert(obj, 'cannot assert function ' + name + ' on object that doesnt exist');
diff --git a/test/role.test.js b/test/role.test.js
index 07de5ae7..23d72a55 100644
--- a/test/role.test.js
+++ b/test/role.test.js
@@ -1012,13 +1012,12 @@ describe('role model', function() {
     it('should fetch all models assigned to the role', function(done) {
       const principalTypesToModels = {};
       let runs = 0;
-      let mappings;
 
       principalTypesToModels[RoleMapping.USER] = User;
       principalTypesToModels[RoleMapping.APPLICATION] = Application;
       principalTypesToModels[RoleMapping.ROLE] = Role;
 
-      mappings = Object.keys(principalTypesToModels);
+      const mappings = Object.keys(principalTypesToModels);
 
       mappings.forEach(function(principalType) {
         const Model = principalTypesToModels[principalType];
@@ -1047,12 +1046,12 @@ describe('role model', function() {
 
     it('should fetch all models only assigned to the role', function(done) {
       const principalTypesToModels = {};
-      let mappings;
 
       principalTypesToModels[RoleMapping.USER] = User;
       principalTypesToModels[RoleMapping.APPLICATION] = Application;
       principalTypesToModels[RoleMapping.ROLE] = Role;
-      mappings = Object.keys(principalTypesToModels);
+
+      const mappings = Object.keys(principalTypesToModels);
 
       async.each(mappings, function(principalType, eachCallback) {
         const Model = principalTypesToModels[principalType];