diff --git a/CHANGELOG b/CHANGELOG
index d1ad4dcc35..fe3f5931c9 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,7 @@
 git-annex (10.20230927) UNRELEASED; urgency=medium
 
   * Ignore directories and other unusual files in .git/annex/journal/
+  * Fix crash of enableremote when the special remote has embedcreds=yes.
 
  -- Joey Hess <id@joeyh.name>  Tue, 10 Oct 2023 13:17:31 -0400
 
diff --git a/Utility/FileMode.hs b/Utility/FileMode.hs
index ecc19d8126..eb25c526d1 100644
--- a/Utility/FileMode.hs
+++ b/Utility/FileMode.hs
@@ -175,10 +175,13 @@ writeFileProtected file content = writeFileProtected' file
 	(\h -> hPutStr h content)
 
 writeFileProtected' :: RawFilePath -> (Handle -> IO ()) -> IO ()
-writeFileProtected' file writer = do
-	h <- protectedOutput $ openFile (fromRawFilePath file) WriteMode
-	void $ tryIO $ modifyFileMode file $ removeModes otherGroupModes
-	writer h
+writeFileProtected' file writer = bracket setup cleanup writer
+  where
+	setup = do
+		h <- protectedOutput $ openFile (fromRawFilePath file) WriteMode
+		void $ tryIO $ modifyFileMode file $ removeModes otherGroupModes
+		return h
+	cleanup = hClose
 
 protectedOutput :: IO a -> IO a
 protectedOutput = withUmask 0o0077
diff --git a/doc/bugs/git_annex_enableremote_locking_issue.mdwn b/doc/bugs/git_annex_enableremote_locking_issue.mdwn
index e3cc0a229f..0fc2ca3f25 100644
--- a/doc/bugs/git_annex_enableremote_locking_issue.mdwn
+++ b/doc/bugs/git_annex_enableremote_locking_issue.mdwn
@@ -52,3 +52,5 @@ git-annex version: 10.20230926-g44a7b4c9734adfda5912dd82c1aa97c615689f57
 ### Have you had any luck using git-annex before? (Sometimes we get tired of reading bug reports all day and a lil' positive end note does wonders)
 
 A great deal, we use it daily in our research and I also use it on some personal files -- thanks for all your efforts Joey et al.!
+
+> Reproduced and fixed. [[done]] --[[Joey]]