diff --git a/scripts/forge-login.sh b/scripts/forge-login.sh
index c0e669d..9c60303 100755
--- a/scripts/forge-login.sh
+++ b/scripts/forge-login.sh
@@ -40,9 +40,21 @@ if [ -z "$token" ]; then
   exit 1
 fi
 
-git config --global user.name "$username"
-git config --global user.email "$email"
-echo "git config: $username <$email>"
+if git config --global user.name "$username" 2>/dev/null \
+  && git config --global user.email "$email" 2>/dev/null; then
+  echo "git config: $username <$email>"
+else
+  cat <<EOF
+git config: --global write failed (read-only ~/.config/git/config?
+  home-manager / nix-managed setup). add this to your home-manager:
+
+  programs.git = {
+    enable = true;
+    userName = "$username";
+    userEmail = "$email";
+  };
+EOF
+fi
 
 # netrc entry — git uses this for HTTP basic auth. 0600 because it
 # contains the plaintext token.