diff --git a/README.rst b/README.rst
index fe68570..bac4d06 100644
--- a/README.rst
+++ b/README.rst
@@ -110,7 +110,8 @@ Usage
       -d DURATION, --duration DURATION
                             Credential duration ($DURATION)
       -p PROFILE, --profile PROFILE
-                            AWS profile ($AWS_PROFILE)
+                            AWS profile (defaults to value of $AWS_PROFILE,
+                            then falls back to 'sts')
       -a ASK_ROLE, --ask-role ASK_ROLE
                             Set true to always pick the role
       -r AWS_ROLE_ARN, --role-arn AWS_ROLE_ARN
diff --git a/aws_google_auth/__init__.py b/aws_google_auth/__init__.py
index 7b35df2..2d3bf2e 100644
--- a/aws_google_auth/__init__.py
+++ b/aws_google_auth/__init__.py
@@ -460,9 +460,8 @@ def cli(cli_args):
                 DurationSeconds=config.duration)
 
     print("Credentials Expiration: " + format(token['Credentials']['Expiration'].astimezone(get_localzone())))
-    if config.profile is None:
-        print_exports(token)
 
+    print_exports(token)
     _store(config, token)
 
 
@@ -482,6 +481,7 @@ def print_exports(token):
 def _store(config, aws_session_token):
 
     def store_config(profile, config_location, storer):
+        assert (profile is not None), "Can not store config/credentials if the AWS_PROFILE is None."
         config_file = configparser.RawConfigParser()
         config_file.read(config_location)
 
diff --git a/aws_google_auth/prepare.py b/aws_google_auth/prepare.py
index 5dca8df..bb86ad8 100644
--- a/aws_google_auth/prepare.py
+++ b/aws_google_auth/prepare.py
@@ -18,7 +18,8 @@ def get_prepared_config(
     def default_if_none(value, default):
         return value if value is not None else default
 
-    google_config.profile = default_if_none(profile, google_config.profile)
+    # If no profile is specified, default to "sts" so we don't clobber the user's default.
+    google_config.profile = default_if_none(profile, google_config.profile) or "sts"
     _create_base_aws_cli_config_files_if_needed(google_config)
 
     if google_config.profile is not None:

Running twice results in malformed credentials file
On Ubuntu with version 0.0.12. Two runs of aws-google-auth results in  ~/.aws/credentials with two "[None]" sections. The config parser of aws-cli throws error configparser.DuplicateSectionError.
diff --git a/aws_google_auth/tests/test_persist_profile.py b/aws_google_auth/tests/test_persist_profile.py
index 19d3f43..feb8156 100644
--- a/aws_google_auth/tests/test_persist_profile.py
+++ b/aws_google_auth/tests/test_persist_profile.py
@@ -107,5 +107,5 @@ class TestPersistConfig(unittest.TestCase):
         self.assertEquals(config.google_sp_id, None)
         self.assertEquals(config.duration, 3600)
         self.assertEquals(config.ask_role, False)
-        self.assertEquals(config.profile, None)
+        self.assertEquals(config.profile, "sts")
         self.assertEquals(config.role_arn, None)

pip install -e .[dev]
parse_log_pytest
requirements.txt
pytest mock
apt-get update apt-get install -y gcc
3.9
requirements.txt
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
-e git+https://github.com/cevoaustralia/aws-google-auth.git@eb991c78bf4e96c30add65f0520b281f916a31ad#egg=aws_google_auth
beautifulsoup4==4.13.3
boto3==1.37.23
botocore==1.37.23
certifi==2025.1.31
charset-normalizer==3.4.1
configparser==7.2.0
exceptiongroup==1.2.2
idna==3.10
iniconfig==2.1.0
jmespath==1.0.1
lxml==5.3.1
mock==5.2.0
packaging==24.2
pluggy==1.5.0
pytest==8.3.5
python-dateutil==2.9.0.post0
requests==2.32.3
s3transfer==0.11.4
six==1.17.0
soupsieve==2.6
tomli==2.2.1
typing_extensions==4.13.0
tzlocal==5.3.1
urllib3==1.26.20

name: aws-google-auth
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.4.4=h6a678d5_1
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=3.0.16=h5eee18b_0
  - pip=25.0=py39h06a4308_0
  - python=3.9.21=he870216_1
  - readline=8.2=h5eee18b_0
  - setuptools=75.8.0=py39h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - tzdata=2025a=h04d1e81_0
  - wheel=0.45.1=py39h06a4308_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - beautifulsoup4==4.13.3
      - boto3==1.37.23
      - botocore==1.37.23
      - certifi==2025.1.31
      - charset-normalizer==3.4.1
      - configparser==7.2.0
      - exceptiongroup==1.2.2
      - idna==3.10
      - iniconfig==2.1.0
      - jmespath==1.0.1
      - lxml==5.3.1
      - mock==5.2.0
      - packaging==24.2
      - pluggy==1.5.0
      - pytest==8.3.5
      - python-dateutil==2.9.0.post0
      - requests==2.32.3
      - s3transfer==0.11.4
      - six==1.17.0
      - soupsieve==2.6
      - tomli==2.2.1
      - typing-extensions==4.13.0
      - tzlocal==5.3.1
      - urllib3==1.26.20
prefix: /opt/conda/envs/aws-google-auth

aws_google_auth/tests/test_persist_profile.py::TestPersistConfig::test_when_there_is_no_profile_use_default_values
aws_google_auth/tests/test_persist_profile.py::TestPersistConfig::test_when_there_is_no_profile_use_supplied_values
README.rst aws_google_auth/prepare.py aws_google_auth/__init__.py
README.rst aws_google_auth/prepare.py aws_google_auth/__init__.py