diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7731311..4c0ba04 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@
 Changes yet to be released are documented here.
 
 - Fix path expansion when running in systemd
+- Fix bug in netrc writing
 - Add nixos, home-manager, and darwin-nix modules
 
 ## v0.1.0
diff --git a/internal/netrc/netrc.go b/internal/netrc/netrc.go
index f020a4d..6eaae73 100644
--- a/internal/netrc/netrc.go
+++ b/internal/netrc/netrc.go
@@ -25,7 +25,7 @@ func Upsert(path, machine, password string) error {
 		}
 	}
 	if !found {
-		entries = append(entries, entry{machine: machine, password: password})
+		entries = append(entries, entry{machine: machine, login: "dummy", password: password})
 	}
 
 	return write(path, entries)
@@ -71,6 +71,7 @@ func GetPassword(path, machine string) (string, error) {
 
 type entry struct {
 	machine  string
+	login    string
 	password string
 }
 
@@ -102,6 +103,10 @@ func parse(path string) ([]entry, error) {
 				entries = append(entries, *current)
 			}
 			current = &entry{machine: fields[1]}
+		case "login":
+			if current != nil {
+				current.login = fields[1]
+			}
 		case "password":
 			if current != nil {
 				current.password = fields[1]
@@ -129,7 +134,7 @@ func write(path string, entries []entry) error {
 		if i > 0 {
 			b.WriteString("\n")
 		}
-		fmt.Fprintf(&b, "machine %s\npassword %s\n", e.machine, e.password)
+		fmt.Fprintf(&b, "machine %s\nlogin %s\npassword %s\n", e.machine, e.login, e.password)
 	}
 
 	if err := os.WriteFile(path, []byte(b.String()), 0600); err != nil {
diff --git a/internal/netrc/netrc_test.go b/internal/netrc/netrc_test.go
index 611c8c4..e8a0b51 100644
--- a/internal/netrc/netrc_test.go
+++ b/internal/netrc/netrc_test.go
@@ -27,7 +27,7 @@ func TestUpsertUpdateExisting(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "netrc")
 
-	initial := "machine other.host\npassword otherpass\n\nmachine cache.example.com\npassword oldtoken\n"
+	initial := "machine other.host\nlogin dummy\npassword otherpass\n\nmachine cache.example.com\nlogin dummy\npassword oldtoken\n"
 	if err := os.WriteFile(path, []byte(initial), 0600); err != nil {
 		t.Fatal(err)
 	}
@@ -59,7 +59,7 @@ func TestUpsertAppend(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "netrc")
 
-	initial := "machine existing.host\npassword existingpass\n"
+	initial := "machine existing.host\nlogin dummy\npassword existingpass\n"
 	if err := os.WriteFile(path, []byte(initial), 0600); err != nil {
 		t.Fatal(err)
 	}
@@ -89,7 +89,7 @@ func TestRemove(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "netrc")
 
-	initial := "machine keep.host\npassword keeppass\n\nmachine remove.host\npassword removepass\n"
+	initial := "machine keep.host\nlogin dummy\npassword keeppass\n\nmachine remove.host\nlogin dummy\npassword removepass\n"
 	if err := os.WriteFile(path, []byte(initial), 0600); err != nil {
 		t.Fatal(err)
 	}
@@ -141,7 +141,7 @@ func TestGetPasswordNotFound(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "netrc")
 
-	content := "machine other.host\npassword otherpass\n"
+	content := "machine other.host\nlogin dummy\npassword otherpass\n"
 	if err := os.WriteFile(path, []byte(content), 0600); err != nil {
 		t.Fatal(err)
 	}
@@ -179,7 +179,7 @@ func TestFilePermissionsCorrected(t *testing.T) {
 	path := filepath.Join(dir, "netrc")
 
 	// Create file with overly permissive mode
-	if err := os.WriteFile(path, []byte("machine old.host\npassword oldpass\n"), 0644); err != nil {
+	if err := os.WriteFile(path, []byte("machine old.host\nlogin dummy\npassword oldpass\n"), 0644); err != nil {
 		t.Fatal(err)
 	}