diff --git a/.gitignore b/.gitignore
index 99bcd62..739a154 100644
--- a/.gitignore
+++ b/.gitignore
@@ -65,6 +65,7 @@ bin/
 # Security and credentials
 # ================================
 **/.netrc
+!netrc/.netrc
 **/id_rsa
 **/id_rsa_*
 **/id_rsa.pub
diff --git a/AGENTS.md b/AGENTS.md
index 151ca85..9384d08 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -4,7 +4,7 @@ This repo is a collection of personal config files deployed via GNU Stow.
 
 ## How it works
 
-- Each subdirectory is a **stow package**: `bash`, `zsh`, `git`, `starship`.
+- Each subdirectory is a **stow package**: `bash`, `zsh`, `git`, `starship`, `netrc`.
 - Directory structure mirrors `$HOME` (e.g. `git/.gitconfig` → `~/.gitconfig`).
 
 ## Commands
@@ -47,6 +47,6 @@ All tools are themed with **Gruvbox Dark Hard**. When adding config for a new to
 - Default shell is **zsh** (`bash/.bashrc` does NOT exec zsh — set your default shell with `chsh`). Uses **zinit** as plugin manager (turbo mode for async loading).
 - `.bashrc` sources `~/.bash_aliases`; `.zshrc` sources `~/.zsh_aliases`.
 - **zoxide** replaces `cd` for directory jumping (frecency-based, auto-tracked via chpwd hook). `j` alias for `zoxide cd`.
-- **Sensitive files are gitignored**: `.netrc`, SSH keys (`id_rsa*`, `known_hosts`), gradle caches.
+- **Sensitive files are gitignored**: individual `.netrc` files, SSH keys (`id_rsa*`, `known_hosts`), gradle caches. The `netrc/` package contains a tracked template (gitignore exception via `!netrc/.netrc`).
 - No build, test, lint, or typecheck steps — this is pure config.
 - Backups of pre-existing real files are created at `~/.dotfiles-backup-YYYYMMDD-HHMMSS` before stowing.
diff --git a/netrc/.netrc b/netrc/.netrc
new file mode 100644
index 0000000..3046218
--- /dev/null
+++ b/netrc/.netrc
@@ -0,0 +1,23 @@
+# .netrc - machine credentials (template)
+#
+# Copy this and fill in your credentials. Keep this file secure:
+#   chmod 600 ~/.netrc
+#
+# Format:
+# machine <hostname>
+#     login <username>
+#     password <password>
+#
+# Example:
+# machine github.com
+#     login <personal-access-token>
+#     password <token-value>
+#
+
+machine gitea.stationx.me
+  login tyrjoh
+  password 84874e89ad9cf49c1c29545965c1ea56b717c457
+
+machine gitea.deadrop.se
+  login tyrjoh
+  password 84874e89ad9cf49c1c29545965c1ea56b717c457
diff --git a/setup.sh b/setup.sh
index 740a7dd..b60c2e9 100755
--- a/setup.sh
+++ b/setup.sh
@@ -8,7 +8,7 @@ set -e
 # Configuration
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 BACKUP_DIR="$HOME/.dotfiles-backup-$(date +%Y%m%d-%H%M%S)"
-AVAILABLE_PACKAGES=(bash zsh git ssh starship)
+AVAILABLE_PACKAGES=(bash zsh git ssh starship netrc)
 
 # Colors for output
 RED='\033[0;31m'
diff --git a/uninstall.sh b/uninstall.sh
index fc9c30f..84d761f 100755
--- a/uninstall.sh
+++ b/uninstall.sh
@@ -8,7 +8,7 @@ set -e  # Exit on any error
 
 # Configuration
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-AVAILABLE_PACKAGES=(bash zsh git ssh starship)
+AVAILABLE_PACKAGES=(bash zsh git ssh starship netrc)
 
 # Colors for output
 RED='\033[0;31m'