diff --git a/lib/travis/vcs/git/netrc.rb b/lib/travis/vcs/git/netrc.rb
index 7a53678188..16dbd5d579 100644
--- a/lib/travis/vcs/git/netrc.rb
+++ b/lib/travis/vcs/git/netrc.rb
@@ -9,7 +9,22 @@ def apply
         end
 
         def delete
-          sh.raw "rm -f ${TRAVIS_HOME}/#{netrc_filename}"
+          host = Shellwords.escape(data.source_host)
+          file_path = "${TRAVIS_HOME}/#{netrc_filename}"
+
+          if netrc_filename == '_netrc'
+            # Windows
+            sh.raw %(
+              powershell -Command "
+                (Get-Content #{file_path}) |
+                  Where-Object { $_ -notmatch 'login|password' } |
+                  Set-Content #{file_path}
+              "
+            )
+          else
+            # Linux/macOS
+            sh.raw "sed -i '/^machine #{host}/,/^$/ { /login/d; /password/d; }' #{file_path}"
+          end
         end
 
         private
diff --git a/public/version-aliases/ghc.json b/public/version-aliases/ghc.json
index 6d1a9c6d72..582a86ac33 100644
--- a/public/version-aliases/ghc.json
+++ b/public/version-aliases/ghc.json
@@ -211,6 +211,7 @@
   "9.6.4": "9.6.4",
   "9.6.5": "9.6.5",
   "9.6.6": "9.6.6",
+  "9.6.7": "9.6.7",
   "9.6.7.20250131": "9.6.7.20250131",
   "9.8.0.20230727": "9.8.0.20230727",
   "9.8.x": "9.8.4",
diff --git a/spec/build/git_spec.rb b/spec/build/git_spec.rb
index 5e362dd8de..d00f9141f8 100644
--- a/spec/build/git_spec.rb
+++ b/spec/build/git_spec.rb
@@ -120,8 +120,12 @@
     context "when keep_netrc is false" do
       before { payload[:keep_netrc] = false }
 
-      it 'deletes .netrc' do
-        should include_sexp [:raw, "rm -f ${TRAVIS_HOME}/.netrc", assert: true]
+      it 'removes credentials from .netrc' do
+        should include_sexp(
+          :raw,
+          %r{^sed -i '/\^machine github\\.com/,/\^\$/ { /login/d; /password/d; }' \$\{TRAVIS_HOME\}/\.netrc$},
+          assert: true
+        )
       end
     end
   end