diff --git a/CHANGELOG.md b/CHANGELOG.md
index 97fe533..a263a91 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -50,8 +50,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - This was the root cause of "authentication hanging" issues
 - **CRITICAL**: Password/token capture no longer includes newline character
   - `prompt_password()` function now outputs formatting to stderr
+  - Added defensive newline stripping when writing config file
+  - Filters `\n` and `\r` characters from passwords using `tr -d '\n\r'`
   - Fixes "authentication failed - invalid credentials" in backup service
   - Config file now has properly formatted single-line passwords
+  - Applied to both `reconfigure_connection()` and `create_systemd_service()`
 - Script no longer hangs indefinitely when PBS server is unreachable
 - Block device auto-detection now correctly handles btrfs subvolumes
 - Invalid device paths like `/dev/mapper/root[/@]` are now properly cleaned
diff --git a/pbs-client-installer.sh b/pbs-client-installer.sh
index e7af36a..fdc5af9 100755
--- a/pbs-client-installer.sh
+++ b/pbs-client-installer.sh
@@ -293,10 +293,14 @@ reconfigure_connection() {
 
     # Update config file with new connection details
     log "Updating configuration file..."
+
+    # Strip any trailing newlines from password (defensive fix)
+    PBS_PASSWORD_CLEAN=$(echo -n "$PBS_PASSWORD" | tr -d '\n\r')
+
     cat > "$CONFIG_DIR/config" <<EOF
 # PBS Client Configuration
 PBS_REPOSITORY="${PBS_REPOSITORY}"
-PBS_PASSWORD="${PBS_PASSWORD}"
+PBS_PASSWORD="${PBS_PASSWORD_CLEAN}"
 BACKUP_TYPE="${BACKUP_TYPE}"
 BACKUP_PATHS="${BACKUP_PATHS}"
 EXCLUDE_PATTERNS="${EXCLUDE_PATTERNS}"
@@ -584,12 +588,15 @@ create_systemd_service() {
     
     # Create config directory
     mkdir -p "$CONFIG_DIR"
-    
+
+    # Strip any trailing newlines from password (defensive fix)
+    PBS_PASSWORD_CLEAN=$(echo -n "$PBS_PASSWORD" | tr -d '\n\r')
+
     # Save configuration
     cat > "$CONFIG_DIR/config" <<EOF
 # PBS Client Configuration
 PBS_REPOSITORY="${PBS_REPOSITORY}"
-PBS_PASSWORD="${PBS_PASSWORD}"
+PBS_PASSWORD="${PBS_PASSWORD_CLEAN}"
 BACKUP_TYPE="${BACKUP_TYPE}"
 BACKUP_PATHS="${BACKUP_PATHS}"
 EXCLUDE_PATTERNS="${EXCLUDE_PATTERNS}"