diff --git a/codex-rs/login/src/lib.rs b/codex-rs/login/src/lib.rs
index 34c88f58..390af74a 100644
--- a/codex-rs/login/src/lib.rs
+++ b/codex-rs/login/src/lib.rs
@@ -75,7 +75,7 @@ pub async fn try_read_openai_api_key(codex_home: &Path) -> std::io::Result<Strin
         auth_dot_json.last_refresh = Utc::now();
 
         let mut options = OpenOptions::new();
-        options.write(true).create(true);
+        options.truncate(true).write(true).create(true);
         #[cfg(unix)]
         {
             options.mode(0o600);