diff --git a/bun.lockb b/bun.lockb
index f3e6291..8fa1e2d 100755
Binary files a/bun.lockb and b/bun.lockb differ
diff --git a/dist/index.js b/dist/index.js
index 5831399..7dc58c1 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -12192,6 +12192,7 @@ async function setUpAutoCache() {
     const output = openSync(outputPath, 'a');
     const log = tailLog(daemonDir);
     const notifyFd = 3;
+    const netrc = await netrcPath();
     const daemon = spawn(daemonBin, [
         '--notify-fd', String(notifyFd),
         '--listen', coreExports.getInput('listen'),
@@ -12202,7 +12203,7 @@ async function setUpAutoCache() {
         '--use-flakehub',
         '--flakehub-cache-server', coreExports.getInput('flakehub-cache-server'),
         '--flakehub-api-server', coreExports.getInput('flakehub-api-server'),
-        '--flakehub-api-server-netrc', path$1.join(process.env['RUNNER_TEMP'], 'determinate-nix-installer-netrc'),
+        '--flakehub-api-server-netrc', netrc,
     ] : []).concat(coreExports.getInput('use-gha-cache') === 'true' ? [
         '--use-gha-cache'
     ] : []), {
@@ -12252,6 +12253,37 @@ async function notifyAutoCache() {
         coreExports.info(`Magic Nix Cache may not be running for this workflow.`);
     }
 }
+async function netrcPath() {
+    const expectedNetrcPath = path$1.join(process.env['RUNNER_TEMP'], 'determinate-nix-installer-netrc');
+    try {
+        await fs$2.access(expectedNetrcPath);
+        return expectedNetrcPath;
+    }
+    catch {
+        // `nix-installer` was not used, the user may be registered with FlakeHub though.
+        const destinedNetrcPath = path$1.join(process.env['RUNNER_TEMP'], 'magic-nix-cache-netrc');
+        try {
+            await flakehub_login(destinedNetrcPath);
+        }
+        catch {
+            coreExports.info("FlakeHub cache disabled.");
+        }
+        return destinedNetrcPath;
+    }
+}
+async function flakehub_login(netrc) {
+    const jwt = await coreExports.getIDToken("api.flakehub.com");
+    await fs$2.writeFile(netrc, [
+        `machine api.flakehub.com login flakehub password ${jwt}`,
+        `machine flakehub.com login flakehub password ${jwt}`,
+    ].join("\n"));
+    coreExports.info("Logging in to FlakeHub.");
+    // the join followed by a match on ^... looks silly, but extra_config
+    // could contain multi-line values
+    if (this.extra_conf?.join("\n").match(/^netrc-file/m)) {
+        coreExports.warning("Logging in to FlakeHub conflicts with the Nix option `netrc-file`.");
+    }
+}
 async function tearDownAutoCache() {
     const daemonDir = process.env[ENV_CACHE_DAEMONDIR];
     if (!daemonDir) {
diff --git a/package.json b/package.json
index d0a0394..52f23d9 100644
--- a/package.json
+++ b/package.json
@@ -10,15 +10,15 @@
   "license": "LGPL",
   "dependencies": {
     "@actions/core": "^1.10.0",
+    "got": "^12.6.0",
     "tail": "^2.2.6",
-    "tslib": "^2.5.2",
-    "got": "^12.6.0"
+    "tslib": "^2.5.2"
   },
   "devDependencies": {
     "@rollup/plugin-commonjs": "^25.0.0",
     "@rollup/plugin-node-resolve": "^15.0.2",
     "@rollup/plugin-typescript": "^11.1.1",
-    "@types/node": "^20.2.1",
+    "@types/node": "^20.11.17",
     "rollup": "^3.22.0",
     "typescript": "^5.0.4"
   }
diff --git a/src/index.ts b/src/index.ts
index cf2790e..fcc366d 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -123,6 +123,8 @@ async function setUpAutoCache() {
   const output = openSync(outputPath, 'a');
   const log = tailLog(daemonDir);
   const notifyFd = 3;
+  const netrc = await netrcPath();
+
   const daemon = spawn(
     daemonBin,
     [
@@ -136,7 +138,7 @@ async function setUpAutoCache() {
         '--use-flakehub',
         '--flakehub-cache-server', core.getInput('flakehub-cache-server'),
         '--flakehub-api-server', core.getInput('flakehub-api-server'),
-        '--flakehub-api-server-netrc', path.join(process.env['RUNNER_TEMP'], 'determinate-nix-installer-netrc'),
+        '--flakehub-api-server-netrc', netrc,
       ] : []).concat(
         core.getInput('use-gha-cache') === 'true' ? [
           '--use-gha-cache'
@@ -196,6 +198,46 @@ async function notifyAutoCache() {
   }
 }
 
+
+async function netrcPath() {
+  const expectedNetrcPath = path.join(process.env['RUNNER_TEMP'], 'determinate-nix-installer-netrc')
+  try {
+    await fs.access(expectedNetrcPath)
+    return expectedNetrcPath;
+  } catch {
+    // `nix-installer` was not used, the user may be registered with FlakeHub though.
+    const destinedNetrcPath = path.join(process.env['RUNNER_TEMP'], 'magic-nix-cache-netrc')
+    try {
+      await flakehub_login(destinedNetrcPath);
+    } catch {
+      core.info("FlakeHub cache disabled.")
+    }
+    return destinedNetrcPath;
+  }
+}
+
+async function flakehub_login(netrc: string) {
+  const jwt = await core.getIDToken("api.flakehub.com");
+
+  await fs.writeFile(
+    netrc,
+    [
+      `machine api.flakehub.com login flakehub password ${jwt}`,
+      `machine flakehub.com login flakehub password ${jwt}`,
+    ].join("\n"),
+  );
+
+  core.info("Logging in to FlakeHub.");
+
+  // the join followed by a match on ^... looks silly, but extra_config
+  // could contain multi-line values
+  if (this.extra_conf?.join("\n").match(/^netrc-file/m)) {
+    core.warning(
+      "Logging in to FlakeHub conflicts with the Nix option `netrc-file`.",
+    );
+  }
+}
+
 async function tearDownAutoCache() {
   const daemonDir = process.env[ENV_CACHE_DAEMONDIR];
 
@@ -258,4 +300,3 @@ try {
   }}
 
 core.debug(`rip`);
-