diff --git a/src/cli/cmd/login/mod.rs b/src/cli/cmd/login/mod.rs
index 2bf08a3..d18d253 100644
--- a/src/cli/cmd/login/mod.rs
+++ b/src/cli/cmd/login/mod.rs
@@ -78,7 +78,6 @@ pub async fn dnixd_uds() -> color_eyre::Result<SendRequest<axum::body::Body>> {
     let response = sender.send_request(request).await?;
 
     if response.status() != StatusCode::OK {
-        tracing::error!("failed to connect to determinate-nixd socket");
         return Err(eyre!("failed to connect to determinate-nixd socket"));
     }
 
@@ -90,10 +89,15 @@ impl LoginSubcommand {
         let dnixd_uds = match dnixd_uds().await {
             Ok(socket) => Some(socket),
             Err(err) => {
-                tracing::error!(
-                    "failed to connect to determinate-nixd socket, will not attempt to use it: {:?}",
-                    err
+                if tracing::enabled!(tracing::Level::DEBUG) {
+                    tracing::debug!(
+                    "failed to connect to determinate-nixd socket, will not attempt to use it: {}", err
                 );
+                } else {
+                    tracing::warn!(
+                        "failed to connect to determinate-nixd socket, will not attempt to use it."
+                    );
+                }
                 None
             }
         };
@@ -195,23 +199,30 @@ impl LoginSubcommand {
                 .body(Body::from(add_req_json))?;
             let response = uds.send_request(request).await?;
 
-            let body = response.into_body();
-            let bytes = body.collect().await.unwrap_or_default().to_bytes();
-            let text: String = String::from_utf8_lossy(&bytes).into();
+            if response.status() != StatusCode::OK {
+                let body = response.into_body();
+                let bytes = body.collect().await.unwrap_or_default().to_bytes();
+                let text: String = String::from_utf8_lossy(&bytes).into();
 
-            tracing::trace!("sent the add request: {:?}", text);
+                tracing::warn!("failed to update netrc via determinate-nixd: {}", &text);
+            }
 
             token_updated = true;
         }
 
         if !token_updated {
             tracing::warn!(
-                "failed to update netrc via determinatenixd, falling back to local-file approach"
+                "failed to update netrc via determinate-nixd, falling back to local-file approach"
             );
 
+            // check if user is root or not
+            if !nix::unistd::Uid::effective().is_root() {
+                return Err(eyre!("`fh login` is attempting to update a file owned by root, please re-run the same command, prefixed with `sudo -i`."));
+            }
+
             update_netrc_file(&netrc_file_path, &netrc_contents).await?;
 
-            // only update user_nix_config if we could not use determinatenixd
+            // only update user_nix_config if we could not use determinate-nixd
             upsert_user_nix_config(
                 &nix_config_path,
                 &netrc_file_string,
diff --git a/src/shared/mod.rs b/src/shared/mod.rs
index cd5b932..70090a9 100644
--- a/src/shared/mod.rs
+++ b/src/shared/mod.rs
@@ -1,6 +1,6 @@
 use std::path::Path;
 
-use color_eyre::eyre::Context as _;
+use color_eyre::eyre::{eyre, Context as _};
 use serde::{Deserialize, Serialize};
 
 #[derive(Deserialize, Serialize)]
@@ -18,6 +18,12 @@ pub async fn update_netrc_file(
     netrc_file_path: &Path,
     netrc_contents: &str,
 ) -> color_eyre::Result<()> {
+    let parent = netrc_file_path
+        .parent()
+        .ok_or(eyre!("failed to determinte netrc parent directory"))?;
+
+    std::fs::create_dir_all(&parent).wrap_err("failed to ensure directory existed: {}")?;
+
     tokio::fs::write(netrc_file_path, &netrc_contents)
         .await
         .wrap_err("failed to update netrc file contents")