diff --git a/src/services/oauth.test.ts b/src/services/oauth.test.ts
new file mode 100644
index 0000000..a4173ff
--- /dev/null
+++ b/src/services/oauth.test.ts
@@ -0,0 +1,8 @@
+import { describe, expect, test } from "bun:test"
+import { OAUTH_LISTEN_HOST } from "./oauth"
+
+describe("oauth callback listener", () => {
+  test("binds OAuth callback server to IPv4 loopback", () => {
+    expect(OAUTH_LISTEN_HOST).toBe("127.0.0.1")
+  })
+})
diff --git a/src/services/oauth.ts b/src/services/oauth.ts
index d29f6bb..987abfd 100644
--- a/src/services/oauth.ts
+++ b/src/services/oauth.ts
@@ -87,7 +87,7 @@ const captureAccessTokenFromHTTPServer = (server: PolarEnvironment) =>
 				}
 			});
 
-			httpServer?.listen(3333, () => {
+			httpServer?.listen(3333, "127.0.0.1", () => {
 				open(authorizationUrl);
 			});
 		});