diff --git a/Gemfile b/Gemfile
index e9107d717..d0a53d494 100644
--- a/Gemfile
+++ b/Gemfile
@@ -111,6 +111,7 @@ group :test do
   gem 'simplecov',      require: false
   gem 'simplecov-lcov', require: false
   gem 'timecop', '~> 0.9.10'
+  gem 'webmock'
 end
 
 group :production do
diff --git a/Gemfile.lock b/Gemfile.lock
index 0edbabec5..987e4d7cd 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -162,6 +162,9 @@ GEM
     commonmarker (2.5.0-x86_64-linux)
     concurrent-ruby (1.3.5)
     connection_pool (2.5.5)
+    crack (1.0.1)
+      bigdecimal
+      rexml
     crass (1.0.6)
     css_parser (1.14.0)
       addressable
@@ -221,6 +224,7 @@ GEM
       rainbow
       rubocop (>= 1.0)
       sysexits (~> 1.1)
+    hashdiff (1.2.1)
     hashie (5.0.0)
     high_voltage (4.0.0)
     htmlentities (4.3.4)
@@ -568,6 +572,10 @@ GEM
       activemodel (>= 6.0.0)
       bindex (>= 0.4.0)
       railties (>= 6.0.0)
+    webmock (3.26.1)
+      addressable (>= 2.8.0)
+      crack (>= 0.3.2)
+      hashdiff (>= 0.4.0, < 2.0.0)
     websocket (1.2.11)
     websocket-driver (0.8.0)
       base64
@@ -668,6 +676,7 @@ DEPENDENCIES
   turbo-rails
   tzinfo-data
   web-console (>= 4.1.0)
+  webmock
 
 RUBY VERSION
    ruby 3.4.7p58
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index 9032c0420..60fb696ab 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -1,6 +1,7 @@
 require 'simplecov'
 require 'simplecov-lcov'
 require 'shoulda/matchers'
+require 'webmock/rspec'
 
 # Fix incompatibility of simplecov-lcov with older versions of simplecov that are not expresses in its gemspec.
 # https://github.com/fortissimo1997/simplecov-lcov/pull/25
@@ -33,6 +34,9 @@ def self.branch_coverage?
 require File.expand_path('../../config/environment', __FILE__)
 require 'rspec/rails'
 
+# Block all external HTTP requests in tests; allows localhost for Capybara
+WebMock.disable_net_connect!(allow_localhost: true)
+
 Dir[Rails.root.join('spec/support/**/*.rb')].each { |f| require f }
 
 ActiveRecord::Migration.check_all_pending! if defined?(ActiveRecord::Migration)
@@ -70,6 +74,11 @@ def self.branch_coverage?
   end
 
   config.before(:each) do
+    # Stub all Flodesk API endpoints globally so tests don't make external requests
+    # when fabricating members (which trigger Subscription.after_create callback)
+    WebMock.stub_request(:any, %r{api\.flodesk\.com}).
+      to_return(status: 200, body: '{"status":"active","segments":[]}', headers: { 'Content-Type' => 'application/json' })
+
     DatabaseCleaner.strategy = :transaction
   end