diff --git a/internal/archive/credentials.go b/internal/archive/credentials.go
index 8a91476a..1f8c3289 100644
--- a/internal/archive/credentials.go
+++ b/internal/archive/credentials.go
@@ -73,20 +73,21 @@ func parseRepoURL(repoURL string) (creds *credentials, query *credentialsQuery,
 	return
 }
 
+const defaultCredsDir = "/etc/apt/auth.conf.d"
+
 var ErrCredentialsNotFound = errors.New("credentials not found")
 
 // findCredentials searches credentials for repoURL in configuration files in
 // directory specified by CHISEL_AUTH_DIR environment variable if it's
 // non-empty, otherwise /etc/apt/auth.conf.d.
 func findCredentials(repoURL string) (*credentials, error) {
-	credsDir := "/etc/apt/auth.conf.d"
+	credsDir := defaultCredsDir
 	if v := os.Getenv("CHISEL_AUTH_DIR"); v != "" {
 		credsDir = v
 	}
 	return findCredentialsInDir(repoURL, credsDir)
 }
 
-var FindCredentials = findCredentials
 // findCredentialsInDir searches for credentials for repoURL in configuration
 // files in credsDir directory. If the directory does not exist, empty
 // credentials structure with nil err is returned.
diff --git a/internal/archive/credentials_test.go b/internal/archive/credentials_test.go
index 6f2802f3..9fe3e75b 100644
--- a/internal/archive/credentials_test.go
+++ b/internal/archive/credentials_test.go
@@ -218,13 +218,13 @@ machine http://example.com/foo login a password
 	},
 }}
 
-func (s *S) TestFindCredentials(c *C) {
+func (s *S) TestFindCredentialsInDir(c *C) {
 	for _, t := range credentialsTests {
-		s.runFindCredentialsTest(c, &t)
+		s.runFindCredentialsInDirTest(c, &t)
 	}
 }
 
-func (s *S) runFindCredentialsTest(c *C, t *credentialsTest) {
+func (s *S) runFindCredentialsInDirTest(c *C, t *credentialsTest) {
 	credsDir := c.MkDir()
 
 	for filename, data := range t.credsFiles {
@@ -249,7 +249,7 @@ func (s *S) runFindCredentialsTest(c *C, t *credentialsTest) {
 	}
 }
 
-func (s *S) TestFindCredentialsMissingDir(c *C) {
+func (s *S) TestFindCredentialsInDirMissingDir(c *C) {
 	var creds *archive.Credentials
 	var err error
 
@@ -277,3 +277,47 @@ func (s *S) TestFindCredentialsMissingDir(c *C) {
 	c.Assert(creds.Username, Equals, "admin")
 	c.Assert(creds.Password, Equals, "swordfish")
 }
+
+func fakeEnv(name, value string) (restore func()) {
+	origValue, origSet := os.LookupEnv(name)
+	os.Setenv(name, value)
+	return func() {
+		if origSet {
+			os.Setenv(name, origValue)
+		} else {
+			os.Unsetenv(name)
+		}
+	}
+}
+
+func (s *S) TestFindCredentials(c *C) {
+	var creds *archive.Credentials
+	var err error
+
+	workDir := c.MkDir()
+	credsDir := filepath.Join(workDir, "auth.conf.d")
+
+	restore := fakeEnv("CHISEL_AUTH_DIR", credsDir)
+	defer restore()
+
+	creds, err = archive.FindCredentials("http://example.com/my/site")
+	c.Assert(err, ErrorMatches, "^credentials not found$")
+	c.Assert(creds, IsNil)
+
+	err = os.Mkdir(credsDir, 0755)
+	c.Assert(err, IsNil)
+
+	creds, err = archive.FindCredentials("http://example.com/my/site")
+	c.Assert(err, ErrorMatches, "^credentials not found$")
+	c.Assert(creds, IsNil)
+
+	confFile := filepath.Join(credsDir, "mysite")
+	err = os.WriteFile(confFile, []byte("machine http://example.com/my login johndoe password 12345"), 0600)
+	c.Assert(err, IsNil)
+
+	creds, err = archive.FindCredentials("http://example.com/my/site")
+	c.Assert(err, IsNil)
+	c.Assert(creds, NotNil)
+	c.Assert(creds.Username, Equals, "johndoe")
+	c.Assert(creds.Password, Equals, "12345")
+}
diff --git a/internal/archive/export_test.go b/internal/archive/export_test.go
index b1c27ec4..fe7c62fb 100644
--- a/internal/archive/export_test.go
+++ b/internal/archive/export_test.go
@@ -16,4 +16,5 @@ func FakeDo(do func(req *http.Request) (*http.Response, error)) (restore func())
 }
 
 type Credentials = credentials
+var FindCredentials = findCredentials
 var FindCredentialsInDir = findCredentialsInDir