diff --git a/bot_bottle/cli/login.py b/bot_bottle/cli/login.py
index 530a69f..4aaf89b 100644
--- a/bot_bottle/cli/login.py
+++ b/bot_bottle/cli/login.py
@@ -91,7 +91,7 @@ def _save_credentials(
         with os.fdopen(fd, "w") as f:
             f.write(content)
         os.replace(tmp, path)
-    except Exception:
+    except OSError:
         try:
             tmp.unlink()
         except OSError:
@@ -117,7 +117,7 @@ def cmd_login(argv: list[str]) -> int:
 
     try:
         resp = _post(f"{console_url}/api/v1/hosts/authorize", {"label": label})
-    except Exception as exc:
+    except (OSError, ValueError) as exc:
         sys.stderr.write(f"bb login: failed to start authorization: {exc}\n")
         return 1
 
@@ -142,7 +142,7 @@ def cmd_login(argv: list[str]) -> int:
             code, result = _get(
                 f"{console_url}/api/v1/hosts/authorize/{device_code}"
             )
-        except Exception:
+        except (OSError, ValueError):
             continue
 
         if code == 410:
diff --git a/tests/unit/test_cli_login.py b/tests/unit/test_cli_login.py
index 7445591..c293854 100644
--- a/tests/unit/test_cli_login.py
+++ b/tests/unit/test_cli_login.py
@@ -42,6 +42,18 @@ class TestSaveCredentials(unittest.TestCase):
             self.assertEqual(data["refresh_token"], "rt")
             self.assertEqual(oct(path.stat().st_mode & 0o777), oct(0o600))
 
+    def test_cleanup_on_write_failure(self) -> None:
+        """Temp file is removed and no credentials remain if replace fails."""
+        from bot_bottle.cli.login import _save_credentials
+
+        with tempfile.TemporaryDirectory() as tmp:
+            with patch.dict(os.environ, {"BOT_BOTTLE_ROOT": tmp}):
+                with patch("os.replace", side_effect=OSError("disk full")):
+                    with self.assertRaises(OSError):
+                        _save_credentials("http://c", "hid", "at", "rt")
+            leftovers = [f for f in os.listdir(tmp) if f.startswith(".console-")]
+            self.assertEqual(leftovers, [])
+
     def test_temp_file_is_private_before_replace(self) -> None:
         """Temp file must be 0600 at the moment os.replace is called."""
         from bot_bottle.cli.login import _save_credentials
@@ -102,11 +114,7 @@ class TestCmdLoginFlow(unittest.TestCase):
             return start_resp
 
         def _fake_get(url):
-            try:
-                resp = next(poll_iter)
-            except StopIteration:
-                return 200, {"status": "pending"}
-            return 200, resp
+            return 200, next(poll_iter, {"status": "pending"})
 
         with patch.dict(os.environ, {"BOT_BOTTLE_ROOT": tmp}):
             with patch("bot_bottle.cli.login._post", side_effect=_fake_post):