lib/PublicInbox/GitCredential.pm | 8 ++++++--
 lib/PublicInbox/NetReader.pm     | 4 ++--

diff --git a/lib/PublicInbox/GitCredential.pm b/lib/PublicInbox/GitCredential.pm
index c83fed43c001ea65f4af08ac2e77efffac670a7e..b18bba1ec32454b29a03339a54c2ed53b17c008c 100644
--- a/lib/PublicInbox/GitCredential.pm
+++ b/lib/PublicInbox/GitCredential.pm
@@ -31,8 +31,12 @@ 	<$out_r> and die "unexpected output from `git credential $op'\n";
 	close $out_r or die "`git credential $op' failed: \$!=$! \$?=$?\n";
 }
 
-sub check_netrc ($) {
-	my ($self) = @_;
+sub check_netrc {
+	my ($self, $lei) = @_;
+
+	# n.b. lei doesn't load ~/.netrc by default, public-inbox-watch does,
+	# which may've been a mistake, but we have to live with it.
+	return if ($lei && !$lei->{opt}->{netrc});
 
 	# part of the standard library, but distributions may split it out
 	eval { require Net::Netrc };
diff --git a/lib/PublicInbox/NetReader.pm b/lib/PublicInbox/NetReader.pm
index a0e52fc5abd18fccc2d600893f72559a3562883e..f0f56431282312c37840809be755cac0007ba51e 100644
--- a/lib/PublicInbox/NetReader.pm
+++ b/lib/PublicInbox/NetReader.pm
@@ -96,7 +96,7 @@ 			$mic->has_capability('AUTH=ANONYMOUS')) {
 		$cred = undef;
 	}
 	if ($cred) {
-		my $p = $cred->{password} // $cred->check_netrc;
+		my $p = $cred->{password} // $cred->check_netrc($lei);
 		$cred->fill($lei) unless defined($p); # may prompt user here
 		$mic->User($mic_arg->{User} = $cred->{username});
 		$mic->Password($mic_arg->{Password} = $cred->{password});
@@ -191,7 +191,7 @@ 			host => $host,
 		}, 'PublicInbox::GitCredential';
 		($u, $p) = split(/:/, $ui, 2);
 		($cred->{username}, $cred->{password}) = ($u, $p);
-		$p //= $cred->check_netrc;
+		$p //= $cred->check_netrc($lei);
 	}
 	my $common = $nn_common->{$sec} // {};
 	my $nn_arg = {