diff --git a/tests/DodoSSH.Api.Tests/StubIdentityProvider.cs b/tests/DodoSSH.Api.Tests/StubIdentityProvider.cs
index b81edce..399bcc5 100644
--- a/tests/DodoSSH.Api.Tests/StubIdentityProvider.cs
+++ b/tests/DodoSSH.Api.Tests/StubIdentityProvider.cs
@@ -6,6 +6,7 @@ using Microsoft.IdentityModel.Tokens;
 using WireMock.RequestBuilders;
 using WireMock.ResponseBuilders;
 using WireMock.Server;
+using WireMock.Settings;
 
 namespace DodoSSH.Api.Tests;
 
@@ -30,7 +31,11 @@ public sealed class StubIdentityProvider : IDisposable
         var rsa = RSA.Create(2048);
         signingKey = new RsaSecurityKey(rsa) { KeyId = KeyId };
 
-        server = WireMockServer.Start();
+        // Loopback explicitly: WireMock's default listens on every interface, which makes Windows Firewall
+        // prompt the first time each test executable runs — per binary path, so a new worktree or
+        // configuration asks again. Port 0 still picks a free port and reports it on server.Url, which is
+        // what Authority below is built from, so the issuer the tokens claim follows the binding.
+        server = WireMockServer.Start(new WireMockServerSettings { Urls = ["http://127.0.0.1:0"] });
         Authority = server.Url!.TrimEnd('/');
 
         StubDiscovery();
diff --git a/tests/DodoSSH.Client.Api.Tests/StubServer.cs b/tests/DodoSSH.Client.Api.Tests/StubServer.cs
index dd5f46d..cd69f49 100644
--- a/tests/DodoSSH.Client.Api.Tests/StubServer.cs
+++ b/tests/DodoSSH.Client.Api.Tests/StubServer.cs
@@ -4,6 +4,7 @@ using DodoSSH.Contracts;
 using WireMock.RequestBuilders;
 using WireMock.ResponseBuilders;
 using WireMock.Server;
+using WireMock.Settings;
 
 namespace DodoSSH.Client.Api.Tests;
 
@@ -15,7 +16,14 @@ namespace DodoSSH.Client.Api.Tests;
 /// </remarks>
 internal sealed class StubServer : IDisposable
 {
-    private readonly WireMockServer server = WireMockServer.Start();
+    /// <remarks>
+    /// Bound to loopback explicitly. WireMock's default listens on every interface, which makes Windows
+    /// Firewall prompt the first time each test executable runs — and the prompt is per binary path, so a
+    /// new worktree or configuration asks again. Port 0 still picks a free port and reports it on
+    /// <see cref="WireMockServer.Url"/>.
+    /// </remarks>
+    private readonly WireMockServer server = WireMockServer.Start(
+        new WireMockServerSettings { Urls = ["http://127.0.0.1:0"] });
 
     internal Uri BaseUrl => new(server.Url!, UriKind.Absolute);
 
diff --git a/tests/DodoSSH.Client.Auth.Tests/StubProvider.cs b/tests/DodoSSH.Client.Auth.Tests/StubProvider.cs
index b235770..c0aa700 100644
--- a/tests/DodoSSH.Client.Auth.Tests/StubProvider.cs
+++ b/tests/DodoSSH.Client.Auth.Tests/StubProvider.cs
@@ -4,6 +4,7 @@ using System.Text.Json.Nodes;
 using WireMock.RequestBuilders;
 using WireMock.ResponseBuilders;
 using WireMock.Server;
+using WireMock.Settings;
 
 namespace DodoSSH.Client.Auth.Tests;
 
@@ -16,7 +17,10 @@ internal sealed class StubProvider : IDisposable
         bool advertiseS256 = true,
         string? issuerOverride = null)
     {
-        server = WireMockServer.Start();
+        // Loopback explicitly: WireMock's default listens on every interface, which makes Windows Firewall
+        // prompt the first time each test executable runs — per binary path, so a new worktree or
+        // configuration asks again. Port 0 still picks a free port and reports it on server.Url.
+        server = WireMockServer.Start(new WireMockServerSettings { Urls = ["http://127.0.0.1:0"] });
         Authority = new Uri(server.Url!.TrimEnd('/'), UriKind.Absolute);
 
         StubDiscovery(advertiseS256, issuerOverride);