diff --git a/Sources/tart/Credentials/DockerConfigCredentialsProvider.swift b/Sources/tart/Credentials/DockerConfigCredentialsProvider.swift
index f4e270c..68fcc28 100644
--- a/Sources/tart/Credentials/DockerConfigCredentialsProvider.swift
+++ b/Sources/tart/Credentials/DockerConfigCredentialsProvider.swift
@@ -104,13 +104,13 @@ struct DockerAuthConfig: Codable {
     guard let data = Data(base64Encoded: authBase64) else {
       return nil
     }
-    guard let components = String(data: data, encoding: .utf8)?.components(separatedBy: ":") else {
+    guard let components = String(data: data, encoding: .utf8)?.split(separator: ":", maxSplits: 1, omittingEmptySubsequences: false) else {
       return nil
     }
     if components.count != 2 {
       return nil
     }
-    return (components[0], components[1])
+    return (String(components[0]), String(components[1]))
   }
 }
 
diff --git a/Tests/TartTests/DockerConfigTests.swift b/Tests/TartTests/DockerConfigTests.swift
index 77aaf60..15887a3 100644
--- a/Tests/TartTests/DockerConfigTests.swift
+++ b/Tests/TartTests/DockerConfigTests.swift
@@ -13,4 +13,12 @@ final class DockerConfigTests: XCTestCase {
     XCTAssertEqual(try config.findCredHelper(host: "456.dkr.ecr.us-east-1.amazonaws.com"), "ecr-login")
     XCTAssertNil(try config.findCredHelper(host: "ghcr.io"))
   }
+
+  func testAuthPasswordWithColons() throws {
+    let auth = Data("user:token:with:colons".utf8).base64EncodedString()
+    let credentials = try XCTUnwrap(DockerAuthConfig(auth: auth).decodeCredentials())
+
+    XCTAssertEqual(credentials.0, "user")
+    XCTAssertEqual(credentials.1, "token:with:colons")
+  }
 }