diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index d81b845..a0d6761 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -96,7 +96,7 @@ def set_hieradata(hieradata)
   }
 
   c.mock_framework = :rspec
-  c.mock_with :mocha
+  c.mock_with :rspec
 
   c.module_path = File.join(fixture_path, 'modules')
   c.manifest_dir = File.join(fixture_path, 'manifests') if c.respond_to?(:manifest_dir)
diff --git a/spec/unit/puppet/provider/selinux_login/semanage_spec.rb b/spec/unit/puppet/provider/selinux_login/semanage_spec.rb
index 6319640..7b7224d 100644
--- a/spec/unit/puppet/provider/selinux_login/semanage_spec.rb
+++ b/spec/unit/puppet/provider/selinux_login/semanage_spec.rb
@@ -16,15 +16,15 @@
   }
 
   before(:each) do
-    Facter.stubs(:value).with(:selinux).returns(true)
-    Facter.stubs(:value).with(:selinux_config_policy).returns('targeted')
-    Facter.stubs(:value).with(:kernel).returns('Linux')
+    allow(Facter).to receive(:value).with(:selinux).and_return(true)
+    allow(Facter).to receive(:value).with(:selinux_config_policy).and_return('targeted')
+    allow(Facter).to receive(:value).with(:kernel).and_return('Linux')
 
     # Stubbing these to 'true' just in case something actually tries them
-    provider.class.stubs(:commands).with(:semanage).returns('/usr/sbin/semanage')
-    provider.class.stubs(:commands).with(:touch).returns('/bin/touch')
+    allow(provider.class).to receive(:commands).with(:semanage).and_return('/usr/sbin/semanage')
+    allow(provider.class).to receive(:commands).with(:touch).and_return('/bin/touch')
 
-    provider.class.stubs(:semanage).with('login', '-l', '-n').returns(
+    allow(provider.class).to receive(:semanage).with('login', '-l', '-n').and_return(
       <<-EOM
 __default__          unconfined_u         s0-s0:c0.c1023       *
 root                 unconfined_u         s0-s0:c0.c1023       *
@@ -58,7 +58,7 @@
 
   context 'create' do
     it 'can create a resource' do
-      provider.class.stubs(:semanage).with(['login', '-a', '-s', resource_hash[:seuser], resource_hash[:name]]).returns('')
+      allow(provider.class).to receive(:semanage).with(['login', '-a', '-s', resource_hash[:seuser], resource_hash[:name]]).and_return('')
 
       provider.create
     end
@@ -73,7 +73,7 @@
     }
 
     it 'can destroy a resource' do
-      provider.class.stubs(:semanage).with('login', '-d', resource_hash[:name]).returns('')
+      allow(provider.class).to receive(:semanage).with('login', '-d', resource_hash[:name]).and_return('')
 
       provider.destroy
     end
@@ -82,8 +82,8 @@
   context 'mls_range?' do
     context 'on an MLS enabled system' do
       before(:each) do
-        File.stubs(:exist?).with('/etc/selinux/targeted/setrans.conf').returns(true)
-        File.stubs(:read).with('/etc/selinux/targeted/setrans.conf').returns(
+        allow(File).to receive(:exist?).with('/etc/selinux/targeted/setrans.conf').and_return(true)
+        allow(File).to receive(:read).with('/etc/selinux/targeted/setrans.conf').and_return(
           <<-EOM
   # s0:c1,c3=CompanyConfidentialBob
   s0=SystemLow
@@ -102,7 +102,7 @@
         }
 
         it 'is in sync' do
-          provider.stubs(:mls_range).returns('s0-s0:c0.c1023')
+          allow(provider).to receive(:mls_range).and_return('s0-s0:c0.c1023')
           expect(resource.property(:mls_range).insync?(provider.mls_range)).to be true
         end
       end
@@ -116,12 +116,12 @@
         }
 
         it 'translates valid MLS ranges' do
-          provider.stubs(:mls_range).returns('s0-s0:c0.c1023')
+          allow(provider).to receive(:mls_range).and_return('s0-s0:c0.c1023')
           expect(resource.property(:mls_range).insync?(provider.mls_range)).to be true
         end
 
         it 'translates invalid valid MLS ranges' do
-          provider.stubs(:mls_range).returns('s0-s0:c0.c11')
+          allow(provider).to receive(:mls_range).and_return('s0-s0:c0.c11')
           expect(resource.property(:mls_range).insync?(provider.mls_range)).to be false
         end
       end
@@ -129,7 +129,7 @@
 
     context 'on system without MLS enabled' do
       before(:each) do
-        File.stubs(:exist?).with('/etc/selinux/targeted/setrans.conf').returns(false)
+        allow(File).to receive(:exist?).with('/etc/selinux/targeted/setrans.conf').and_return(false)
       end
 
       context 'ignores the :mls_range setting' do
@@ -141,7 +141,7 @@
         }
 
         it 'is in sync' do
-          provider.stubs(:mls_range).returns(nil)
+          allow(provider).to receive(:mls_range).and_return(nil)
 
           expect(resource.property(:mls_range).insync?(provider.mls_range)).to be true
         end
@@ -152,7 +152,7 @@
   context 'flush' do
     context 'when :seuser is specified' do
       it 'modifies the :seuser' do
-        provider.class.stubs(:semanage).with(['login', '-m', '-s', resource_hash[:seuser], resource_hash[:name]]).returns('')
+        allow(provider.class).to receive(:semanage).with(['login', '-m', '-s', resource_hash[:seuser], resource_hash[:name]]).and_return('')
 
         provider.flush
       end
@@ -165,7 +165,7 @@
       }}
 
       it 'modifies the :mls_range' do
-        provider.class.stubs(:semanage).with(['login', '-m', '-r', resource_hash[:mls_range], resource_hash[:name]]).returns('')
+        allow(provider.class).to receive(:semanage).with(['login', '-m', '-r', resource_hash[:mls_range], resource_hash[:name]]).and_return('')
 
         provider.flush
       end
@@ -179,7 +179,7 @@
       }}
 
       it 'modifies :seuser and :mls_range' do
-        provider.class.stubs(:semanage).with(['login', '-m', '-s', resource_hash[:seuser], '-r', resource_hash[:mls_range], resource_hash[:name]]).returns('')
+        allow(provider.class).to receive(:semanage).with(['login', '-m', '-s', resource_hash[:seuser], '-r', resource_hash[:mls_range], resource_hash[:name]]).and_return('')
 
         provider.flush
       end
diff --git a/spec/unit/puppet/provider/selinux_state/selinux_state_spec.rb b/spec/unit/puppet/provider/selinux_state/selinux_state_spec.rb
index 5cf5886..db1e9ff 100644
--- a/spec/unit/puppet/provider/selinux_state/selinux_state_spec.rb
+++ b/spec/unit/puppet/provider/selinux_state/selinux_state_spec.rb
@@ -16,63 +16,63 @@
   describe 'relabel?' do
     context 'enforcing -> enforcing' do
       it 'does not need relabeling' do
-        provider.stubs(:ensure).returns 'enforcing'
+        allow(provider).to receive(:ensure).and_return 'enforcing'
         expect(provider.relabel?('enforcing')).to be_falsey
       end
     end
 
     context 'enforcing -> permissive' do
       it 'does not need relabeling' do
-        provider.stubs(:ensure).returns 'enforcing'
+        allow(provider).to receive(:ensure).and_return 'enforcing'
         expect(provider.relabel?('permissive')).to be_falsey
       end
     end
 
     context 'enforcing -> disabled' do
       it 'does not need relabeling' do
-        provider.stubs(:ensure).returns 'enforcing'
+        allow(provider).to receive(:ensure).and_return 'enforcing'
         expect(provider.relabel?('disabled')).to be_falsey
       end
     end
 
     context 'permissive -> enforcing' do
       it 'needs relabeling' do
-        provider.stubs(:ensure).returns 'permissive'
+        allow(provider).to receive(:ensure).and_return 'permissive'
         expect(provider.relabel?('enforcing')).to be_truthy
       end
     end
 
     context 'permissive -> permissive' do
       it 'does not need relabeling' do
-        provider.stubs(:ensure).returns 'permissive'
+        allow(provider).to receive(:ensure).and_return 'permissive'
         expect(provider.relabel?('permissive')).to be_falsey
       end
     end
 
     context 'permissive -> disabled' do
       it 'does not need relabeling' do
-        provider.stubs(:ensure).returns 'permissive'
+        allow(provider).to receive(:ensure).and_return 'permissive'
         expect(provider.relabel?('disabled')).to be_falsey
       end
     end
 
     context 'disabled -> enforcing' do
       it 'needs relabeling' do
-        provider.stubs(:ensure).returns 'disabled'
+        allow(provider).to receive(:ensure).and_return 'disabled'
         expect(provider.relabel?('enforcing')).to be_truthy
       end
     end
 
     context 'disabled -> permissive' do
       it 'needs relabeling' do
-        provider.stubs(:ensure).returns 'disabled'
+        allow(provider).to receive(:ensure).and_return 'disabled'
         expect(provider.relabel?('permissive')).to be_truthy
       end
     end
 
     context 'disabled -> disabled' do
       it 'does not need relabeling' do
-        provider.stubs(:ensure).returns 'disabled'
+        allow(provider).to receive(:ensure).and_return 'disabled'
         expect(provider.relabel?('disabled')).to be_falsey
       end
     end