diff --git a/Cargo.lock b/Cargo.lock
index 05d8c0f..3860454 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -640,7 +640,7 @@ checksum = "9fc0510504f03c51ada170672ac806f1f105a88aa97a5281117e1ddc3368e51a"
 
 [[package]]
 name = "fh"
-version = "0.1.18"
+version = "0.1.19"
 dependencies = [
  "async-trait",
  "axum",
diff --git a/Cargo.toml b/Cargo.toml
index 9d00c52..ef5affb 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "fh"
-version = "0.1.18"
+version = "0.1.19"
 authors = ["Determinate Systems <hello@determinate.systems>"]
 edition = "2021"
 license = "Apache 2.0"
diff --git a/flake.lock b/flake.lock
index d2f2859..adaa199 100644
--- a/flake.lock
+++ b/flake.lock
@@ -8,12 +8,12 @@
         "rust-analyzer-src": "rust-analyzer-src"
       },
       "locked": {
-        "lastModified": 1725172314,
-        "narHash": "sha256-BtLY9lWu/pe6/ImFwuRRRqMwLacY5AZOKA2hUHUQ64k=",
-        "rev": "28b42d01f549c38bd165296fbcb4fe66d98fc24f",
-        "revCount": 1986,
+        "lastModified": 1727764514,
+        "narHash": "sha256-tvN9v5gTxLI5zOKsNvYl1aUxIitHm8Nj3vKdXNfJo50=",
+        "rev": "a9d2e5fa8d77af05240230c9569bbbddd28ccfaf",
+        "revCount": 2029,
         "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/nix-community/fenix/0.1.1986%2Brev-28b42d01f549c38bd165296fbcb4fe66d98fc24f/0191aca7-e3ea-728d-bfd8-c4744f4a108d/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/nix-community/fenix/0.1.2029%2Brev-a9d2e5fa8d77af05240230c9569bbbddd28ccfaf/01924729-44b5-7df4-a70d-d5e64656e243/source.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -41,12 +41,12 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1726463316,
-        "narHash": "sha256-gI9kkaH0ZjakJOKrdjaI/VbaMEo9qBbSUl93DnU7f4c=",
-        "rev": "99dc8785f6a0adac95f5e2ab05cc2e1bf666d172",
-        "revCount": 681973,
+        "lastModified": 1729665710,
+        "narHash": "sha256-AlcmCXJZPIlO5dmFzV3V2XF6x/OpNWUV8Y/FMPGd8Z4=",
+        "rev": "2768c7d042a37de65bb1b5b3268fc987e534c49d",
+        "revCount": 696158,
         "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.681973%2Brev-99dc8785f6a0adac95f5e2ab05cc2e1bf666d172/0191fe06-77c6-7f96-9835-e6a8ac5c4059/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.696158%2Brev-2768c7d042a37de65bb1b5b3268fc987e534c49d/0192bd28-d6c0-735c-ab86-8ab9d12f7d62/source.tar.gz"
       },
       "original": {
         "type": "tarball",
@@ -63,11 +63,11 @@
     "rust-analyzer-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1725094379,
-        "narHash": "sha256-TBujPMMIv8RG6BKlsBEpCln1ePmWz79xTcJOQpU2L18=",
+        "lastModified": 1727706011,
+        "narHash": "sha256-xxgUHwwJ+1xQQoUWvLDo807IZ0MDldkfr9N1G4fvNJU=",
         "owner": "rust-lang",
         "repo": "rust-analyzer",
-        "rev": "914a1caab54e48a028b2407d0fe6fade89532f67",
+        "rev": "28830ff2f1158ee92f4852ef3ec35af0935d1562",
         "type": "github"
       },
       "original": {
diff --git a/src/cli/cmd/login/mod.rs b/src/cli/cmd/login/mod.rs
index f79f075..d7e7b38 100644
--- a/src/cli/cmd/login/mod.rs
+++ b/src/cli/cmd/login/mod.rs
@@ -12,8 +12,8 @@ use hyper_util::rt::TokioIo;
 use tokio::io::AsyncWriteExt;
 use tokio::net::UnixStream;
 
-use crate::cli::cmd::FlakeHubClient;
 use crate::cli::cmd::TokenStatus;
+use crate::cli::cmd::{get_netrc_path, FlakeHubClient};
 use crate::cli::error::FhError;
 use crate::shared::{update_netrc_file, NetrcTokenAddRequest};
 use crate::{DETERMINATE_NIXD_SOCKET_NAME, DETERMINATE_STATE_DIR};
@@ -191,7 +191,7 @@ impl LoginSubcommand {
 
             let xdg = xdg::BaseDirectories::new()?;
 
-            let netrc_path = xdg.place_config_file("nix/netrc")?;
+            let netrc_path = get_netrc_path(&xdg).await?;
 
             // $XDG_CONFIG_HOME/nix/nix.conf; basically ~/.config/nix/nix.conf
             let nix_config_path = xdg.place_config_file("nix/nix.conf")?;
diff --git a/src/cli/cmd/mod.rs b/src/cli/cmd/mod.rs
index 8805579..2d41af4 100644
--- a/src/cli/cmd/mod.rs
+++ b/src/cli/cmd/mod.rs
@@ -10,7 +10,7 @@ pub(crate) mod resolve;
 pub(crate) mod search;
 pub(crate) mod status;
 
-use std::{fmt::Display, process::Stdio};
+use std::{fmt::Display, path::PathBuf, process::Stdio};
 
 use color_eyre::eyre::WrapErr;
 use once_cell::sync::Lazy;
@@ -23,7 +23,9 @@ use tabled::settings::{
     style::{HorizontalLine, On, VerticalLineIter},
     Style,
 };
+use tokio::fs::try_exists;
 use url::Url;
+use xdg::BaseDirectories;
 
 use self::{
     init::command_exists,
@@ -36,6 +38,9 @@ use crate::{flakehub_url, APP_USER_AGENT};
 
 use super::error::FhError;
 
+const DETERMINATE_NIX_NETRC_PATH: &str = "/nix/var/determinate/netrc";
+const XDG_NIX_NETRC_SUFFIX: &str = "nix/netrc";
+
 #[allow(clippy::type_complexity)]
 static DEFAULT_STYLE: Lazy<
     Style<
@@ -477,6 +482,22 @@ fn validate_segment(s: &str) -> Result<(), FhError> {
     Ok(())
 }
 
+// See if the netrc exists at the /nix/var/determinate/netrc and, if not, try
+// to find it via XDG path.
+async fn get_netrc_path(xdg: &BaseDirectories) -> Result<PathBuf, FhError> {
+    match try_exists(DETERMINATE_NIX_NETRC_PATH).await {
+        Ok(exists) if exists => Ok(DETERMINATE_NIX_NETRC_PATH.into()),
+        _ => {
+            let xdg_path = xdg.place_config_file(XDG_NIX_NETRC_SUFFIX)?;
+
+            match try_exists(&xdg_path).await {
+                Ok(exists) if exists => Ok(xdg_path),
+                _ => Err(FhError::NetrcNotFound(xdg_path.display().to_string())),
+            }
+        }
+    }
+}
+
 #[cfg(test)]
 mod tests {
     #[test]
diff --git a/src/cli/error.rs b/src/cli/error.rs
index 94bd0c6..e51b65f 100644
--- a/src/cli/error.rs
+++ b/src/cli/error.rs
@@ -39,6 +39,9 @@ pub(crate) enum FhError {
     #[error("missing from flake output reference: {0}")]
     MissingFromOutputRef(String),
 
+    #[error("netrc file not found at {0}")]
+    NetrcNotFound(String),
+
     #[error("the flake has no inputs")]
     NoInputs,