diff --git a/.circleci/config.yml b/.circleci/config.yml
index 23fcf9e1..ce245629 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -6,6 +6,25 @@ jobs:
     working_directory: ~/intercom-ruby
     steps:
       - checkout
+      - run:
+          name: Route Bundler through the Socket Firewall registry
+          command: |
+            set -euo pipefail
+            if [ -z "${SOCKET_GEM_URL:-}" ]; then
+              # CircleCI does not share context credentials with forked PRs, so a
+              # fork cannot be routed. Say so rather than failing the contributor.
+              if [ -n "${CIRCLE_PR_REPONAME:-}" ]; then
+                echo "Forked PR: no Socket Firewall credentials available, gems will come from rubygems.org."
+                exit 0
+              fi
+              echo "FATAL: SOCKET_GEM_URL is required (provided by the socket-firewall context)"
+              exit 1
+            fi
+            # Legacy two-argument form: these images ship Bundler 1.x, where
+            # `bundle config set --global` does not exist and silently no-ops.
+            bundle config mirror.https://rubygems.org "$SOCKET_GEM_URL"
+            bundle config mirror.https://rubygems.org | grep -q socket-firewall-registry \
+              || { echo "FAIL: bundler mirror not pointing at Socket Firewall"; exit 1; }
       - run: bundle install
       - run: bundle exec rake
   "Test against Ruby 2.5":
@@ -14,6 +33,21 @@ jobs:
     working_directory: ~/intercom-ruby
     steps:
       - checkout
+      - run:
+          name: Route Bundler through the Socket Firewall registry
+          command: |
+            set -euo pipefail
+            if [ -z "${SOCKET_GEM_URL:-}" ]; then
+              if [ -n "${CIRCLE_PR_REPONAME:-}" ]; then
+                echo "Forked PR: no Socket Firewall credentials available, gems will come from rubygems.org."
+                exit 0
+              fi
+              echo "FATAL: SOCKET_GEM_URL is required (provided by the socket-firewall context)"
+              exit 1
+            fi
+            bundle config mirror.https://rubygems.org "$SOCKET_GEM_URL"
+            bundle config mirror.https://rubygems.org | grep -q socket-firewall-registry \
+              || { echo "FAIL: bundler mirror not pointing at Socket Firewall"; exit 1; }
       - run: bundle install
       - run: bundle exec rake
   "Test against Ruby 2.6":
@@ -22,6 +56,21 @@ jobs:
     working_directory: ~/intercom-ruby
     steps:
       - checkout
+      - run:
+          name: Route Bundler through the Socket Firewall registry
+          command: |
+            set -euo pipefail
+            if [ -z "${SOCKET_GEM_URL:-}" ]; then
+              if [ -n "${CIRCLE_PR_REPONAME:-}" ]; then
+                echo "Forked PR: no Socket Firewall credentials available, gems will come from rubygems.org."
+                exit 0
+              fi
+              echo "FATAL: SOCKET_GEM_URL is required (provided by the socket-firewall context)"
+              exit 1
+            fi
+            bundle config mirror.https://rubygems.org "$SOCKET_GEM_URL"
+            bundle config mirror.https://rubygems.org | grep -q socket-firewall-registry \
+              || { echo "FAIL: bundler mirror not pointing at Socket Firewall"; exit 1; }
       - run: bundle install
       - run: bundle exec rake
 
@@ -29,7 +78,12 @@ workflows:
   version: 2
   build_and_test:
     jobs:
-      - "Test against Ruby 2.4"
-      - "Test against Ruby 2.5"
-      - "Test against Ruby 2.6"
-
+      - "Test against Ruby 2.4":
+          context:
+            - socket-firewall
+      - "Test against Ruby 2.5":
+          context:
+            - socket-firewall
+      - "Test against Ruby 2.6":
+          context:
+            - socket-firewall
diff --git a/Gemfile b/Gemfile
index 4516ffc0..0cfe52d3 100644
--- a/Gemfile
+++ b/Gemfile
@@ -1,4 +1,4 @@
-source "http://rubygems.org"
+source "https://rubygems.org"
 
 gem 'webmock'
 gemspec