diff --git a/tests/integration/withings-oauth-flow.test.ts b/tests/integration/withings-oauth-flow.test.ts
index 4cf7faf7d..f6edb6d75 100644
--- a/tests/integration/withings-oauth-flow.test.ts
+++ b/tests/integration/withings-oauth-flow.test.ts
@@ -270,8 +270,15 @@ describe("Withings OAuth nonce ledger (real Postgres)", () => {
       "withings=error&reason=expired",
     );
 
-    // Token endpoint never hit.
-    expect(fetchSpy).not.toHaveBeenCalled();
+    // Token endpoint never hit. Scope the assertion to the token URL so a
+    // prior connection's fire-and-forget webhook subscriptions, which resolve
+    // asynchronously into this spy, cannot make the check flaky.
+    const tokenCalls = fetchSpy.mock.calls.filter(
+      ([input]) =>
+        (typeof input === "string" ? input : (input as Request).url) ===
+        WITHINGS_TOKEN_URL,
+    );
+    expect(tokenCalls).toHaveLength(0);
 
     // The handler stamps out the expired row so a clock-skewed replay
     // can't slip through.