diff --git a/scm-plugins/scm-hg-plugin/src/main/java/sonia/scm/repository/spi/HgCommandContext.java b/scm-plugins/scm-hg-plugin/src/main/java/sonia/scm/repository/spi/HgCommandContext.java
index 5169d3c389..2679a3473d 100644
--- a/scm-plugins/scm-hg-plugin/src/main/java/sonia/scm/repository/spi/HgCommandContext.java
+++ b/scm-plugins/scm-hg-plugin/src/main/java/sonia/scm/repository/spi/HgCommandContext.java
@@ -33,6 +33,7 @@ import sonia.scm.repository.HgRepositoryHandler;
 import sonia.scm.repository.RepositoryProvider;
 
 import java.io.Closeable;
+import java.io.File;
 
 //~--- JDK imports ------------------------------------------------------------
 
@@ -71,6 +72,10 @@ public class HgCommandContext implements Closeable, RepositoryProvider {
     return handler.getConfig();
   }
 
+  public File getDirectory() {
+    return handler.getDirectory(scmRepository.getId());
+  }
+
   public sonia.scm.repository.Repository getScmRepository() {
     return scmRepository;
   }
diff --git a/scm-plugins/scm-hg-plugin/src/main/java/sonia/scm/repository/spi/HgPullCommand.java b/scm-plugins/scm-hg-plugin/src/main/java/sonia/scm/repository/spi/HgPullCommand.java
index 3eeab694a5..8974fb88ed 100644
--- a/scm-plugins/scm-hg-plugin/src/main/java/sonia/scm/repository/spi/HgPullCommand.java
+++ b/scm-plugins/scm-hg-plugin/src/main/java/sonia/scm/repository/spi/HgPullCommand.java
@@ -30,41 +30,83 @@ import com.google.common.base.Strings;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import sonia.scm.ContextEntry;
+import sonia.scm.io.INIConfiguration;
+import sonia.scm.io.INIConfigurationReader;
+import sonia.scm.io.INIConfigurationWriter;
+import sonia.scm.io.INISection;
 import sonia.scm.repository.HgRepositoryHandler;
 import sonia.scm.repository.api.ImportFailedException;
 import sonia.scm.repository.api.PullResponse;
 
+import java.io.File;
 import java.io.IOException;
+import java.net.URI;
 import java.util.List;
 
 public class HgPullCommand extends AbstractHgPushOrPullCommand implements PullCommand {
 
-  private static final Logger logger = LoggerFactory.getLogger(HgPullCommand.class);
+  private static final Logger LOG = LoggerFactory.getLogger(HgPullCommand.class);
+  private static final String AUTH_SECTION = "auth";
 
   public HgPullCommand(HgRepositoryHandler handler, HgCommandContext context) {
     super(handler, context);
   }
 
   @Override
-  @SuppressWarnings("unchecked")
+  @SuppressWarnings({"java:S3252"})
   public PullResponse pull(PullCommandRequest request)
     throws IOException {
     String url = getRemoteUrl(request);
 
-    logger.debug("pull changes from {} to {}", url, getContext().getScmRepository().getId());
+    LOG.debug("pull changes from {} to {}", url, getContext().getScmRepository().getId());
 
     List<Changeset> result;
 
     if (!Strings.isNullOrEmpty(request.getUsername()) && !Strings.isNullOrEmpty(request.getPassword())) {
-      url = url.replace("://", String.format("://%s:%s@", request.getUsername(), request.getPassword()));
+      addAuthenticationConfig(request, url);
     }
 
     try {
       result = com.aragost.javahg.commands.PullCommand.on(open()).execute(url);
     } catch (ExecutionException ex) {
       throw new ImportFailedException(ContextEntry.ContextBuilder.entity(getRepository()).build(), "could not execute pull command", ex);
+    } finally {
+      removeAuthenticationConfig();
     }
 
     return new PullResponse(result.size());
   }
+
+  public void addAuthenticationConfig(PullCommandRequest request, String url) throws IOException {
+    INIConfiguration ini = readIniConfiguration();
+    INISection authSection = ini.getSection(AUTH_SECTION);
+    if (authSection == null) {
+      authSection = new INISection(AUTH_SECTION);
+      ini.addSection(authSection);
+    }
+    URI parsedUrl = URI.create(url);
+    authSection.setParameter("import.prefix", parsedUrl.getHost());
+    authSection.setParameter("import.schemes", parsedUrl.getScheme());
+    authSection.setParameter("import.username", request.getUsername());
+    authSection.setParameter("import.password", request.getPassword());
+    writeIniConfiguration(ini);
+  }
+
+  public void removeAuthenticationConfig() throws IOException {
+    INIConfiguration ini = readIniConfiguration();
+    ini.removeSection(AUTH_SECTION);
+    writeIniConfiguration(ini);
+  }
+
+  public INIConfiguration readIniConfiguration() throws IOException {
+    return new INIConfigurationReader().read(getHgrcFile());
+  }
+
+  public void writeIniConfiguration(INIConfiguration ini) throws IOException {
+    new INIConfigurationWriter().write(ini, getHgrcFile());
+  }
+
+  public File getHgrcFile() {
+    return new File(getContext().getDirectory(), HgRepositoryHandler.PATH_HGRC);
+  }
 }