diff --git a/internal/vpn/run.go b/internal/vpn/run.go
index 082cf9ba4..6e9226428 100644
--- a/internal/vpn/run.go
+++ b/internal/vpn/run.go
@@ -40,6 +40,17 @@ func (l *Loop) Run(ctx context.Context, done chan<- struct{}) {
 			vpnRunner, serverName, err = setupOpenVPN(ctx, l.fw,
 				l.openvpnConf, providerConf, settings, l.ipv6Supported, l.starter, subLogger)
 		} else { // Wireguard
+			// save auth in case of PIA for port forwarding and getting the wg config
+			if *settings.Provider.Name == "private internet access" {
+				if *settings.OpenVPN.User != "" {
+					err := l.openvpnConf.WriteAuthFile(*settings.OpenVPN.User, *settings.OpenVPN.Password)
+					if err != nil {
+						l.crashed(ctx, fmt.Errorf("writing auth to file: %w", err))
+						continue
+					}
+				}
+			}
+
 			vpnInterface = settings.Wireguard.Interface
 			vpnRunner, serverName, err = setupWireguard(ctx, l.netLinker, l.fw,
 				providerConf, settings, l.ipv6Supported, subLogger)