diff --git a/README.md b/README.md
index 4a990388..a6a273f6 100644
--- a/README.md
+++ b/README.md
@@ -67,6 +67,10 @@ private_key: |
     <td><code>password</code> (Optional)</td>
     <td>Password for HTTP(S) auth when pulling/pushing.</td>
   </tr>
+  <tr>
+    <td><code>credential_hosts</code> (Optional)</td>
+    <td>List of hostnames the HTTP(S) <code>username</code>/<code>password</code> may be sent to. When set, the credentials are written to <code>.netrc</code> scoped to these hosts instead of the <code>default</code> entry, which matches every host. Hosts are specified with no protocol, e.g. <code>github.com</code>. Submodules on hosts not listed here will not receive these credentials; use <code>submodule_credentials</code> for those. When omitted, credentials match all hosts (previous behavior).</td>
+  </tr>
   <tr>
     <td><code>skip_ssl_verification</code> (Optional)</td>
     <td>Skips git ssl verification by exporting <code>GIT_SSL_NO_VERIFY=true</code>.</td>
diff --git a/assets/common.sh b/assets/common.sh
index 6a2faccb..38f9a060 100644
--- a/assets/common.sh
+++ b/assets/common.sh
@@ -282,7 +282,14 @@ configure_credentials() {
   configure_submodule_credentials "$1"
 
   if [ "$username" != "" -a "$password" != "" ]; then
-    echo "default login $username password $password" >> "${HOME}/.netrc"
+    local credential_hosts=$(jq -r '(.source.credential_hosts // []) | if type == "array" then .[] else . end' <<< "$1")
+    if [ "$credential_hosts" != "" ]; then
+      for host in $credential_hosts; do
+        echo "machine $host login $username password $password" >> "${HOME}/.netrc"
+      done
+    else
+      echo "default login $username password $password" >> "${HOME}/.netrc"
+    fi
   fi
 }
 
diff --git a/assets/source_schema.json b/assets/source_schema.json
index b9fa8775..36964c81 100644
--- a/assets/source_schema.json
+++ b/assets/source_schema.json
@@ -8,6 +8,7 @@
   "forward_agent": "",
   "username": "",
   "password": "",
+  "credential_hosts": "",
   "paths": "",
   "sparse_paths": "",
   "ignore_paths": "",
diff --git a/test/check.sh b/test/check.sh
index 04df6677..64fcd7a3 100755
--- a/test/check.sh
+++ b/test/check.sh
@@ -168,6 +168,31 @@ EOF
   [ ! -f "$HOME/.netrc" ]
 }
 
+it_scopes_credentials_to_credential_hosts() {
+  local repo=$(init_repo)
+  local ref=$(make_commit "$repo")
+  local expected_netrc
+  expected_netrc=$(cat <<EOF
+machine host1 login user1 password pass1
+machine host2 login user1 password pass1
+EOF
+)
+  check_uri_with_credential_hosts "$repo" "user1" "pass1" "host1 host2" | jq -e "
+    . == [{ref: $(echo $ref | jq -R .)}]
+  "
+  echo "Generated netrc $(cat ${HOME}/.netrc)"
+  echo "Expected netrc $expected_netrc"
+  [ "$(cat $HOME/.netrc)" = "$expected_netrc" ]
+
+  # no default entry: the credentials must not match hosts outside the list
+  ! grep -q "^default " $HOME/.netrc
+
+  check_uri_with_credentials $repo "" "" | jq -e "
+    . == [{ref: $(echo $ref | jq -R .)}]
+  "
+  [ ! -f "$HOME/.netrc" ]
+}
+
 it_clears_netrc_even_after_errors() {
   local repo=$(init_repo)
   local ref=$(make_commit $repo)
@@ -1190,6 +1215,7 @@ run it_configures_forward_agent
 run it_skips_forward_agent_configuration
 run it_can_check_with_credentials
 run it_can_check_with_submodule_credentials
+run it_scopes_credentials_to_credential_hosts
 run it_clears_netrc_even_after_errors
 run it_can_check_empty_commits
 run it_can_check_with_tag_filter
diff --git a/test/helpers.sh b/test/helpers.sh
index 47c16e9d..053fc3a8 100644
--- a/test/helpers.sh
+++ b/test/helpers.sh
@@ -408,6 +408,17 @@ check_uri_with_submodule_credentials() {
   }" | ${resource_dir}/check | tee /dev/stderr
 }
 
+check_uri_with_credential_hosts() {
+  jq -n "{
+    source: {
+      uri: $(echo $1 | jq -R .),
+      username: $(echo $2 | jq -R .),
+      password: $(echo $3 | jq -R .),
+      credential_hosts: $(echo "$4" | jq -R '. | split(" ")')
+    }
+  }" | ${resource_dir}/check | tee /dev/stderr
+}
+
 check_uri_ignoring() {
   local uri=$1