diff --git a/acceptance/cmd/auth/login/custom-config-file/out.databrickscfg b/acceptance/cmd/auth/login/custom-config-file/out.databrickscfg
new file mode 100644
index 0000000000..e228e10bc6
--- /dev/null
+++ b/acceptance/cmd/auth/login/custom-config-file/out.databrickscfg
@@ -0,0 +1,6 @@
+; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
+[DEFAULT]
+
+[custom-test]
+host      = [DATABRICKS_URL]
+auth_type = databricks-cli
diff --git a/acceptance/cmd/auth/login/custom-config-file/out.test.toml b/acceptance/cmd/auth/login/custom-config-file/out.test.toml
new file mode 100644
index 0000000000..d560f1de04
--- /dev/null
+++ b/acceptance/cmd/auth/login/custom-config-file/out.test.toml
@@ -0,0 +1,5 @@
+Local = true
+Cloud = false
+
+[EnvMatrix]
+  DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/login/custom-config-file/output.txt b/acceptance/cmd/auth/login/custom-config-file/output.txt
new file mode 100644
index 0000000000..79e67f48b2
--- /dev/null
+++ b/acceptance/cmd/auth/login/custom-config-file/output.txt
@@ -0,0 +1,21 @@
+
+=== Initial custom config file (with old host)
+[custom-test]
+host = https://old-host.cloud.databricks.com
+auth_type = pat
+token = old-token-123
+
+=== Login with new host (should override old host)
+>>> [CLI] auth login --host [DATABRICKS_URL] --profile custom-test
+Profile custom-test was successfully saved
+
+=== Default config file should NOT exist
+OK: Default .databrickscfg does not exist
+
+=== Custom config file after login (old host should be replaced)
+; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
+[DEFAULT]
+
+[custom-test]
+host      = [DATABRICKS_URL]
+auth_type = databricks-cli
diff --git a/acceptance/cmd/auth/login/custom-config-file/script b/acceptance/cmd/auth/login/custom-config-file/script
new file mode 100644
index 0000000000..8be849974e
--- /dev/null
+++ b/acceptance/cmd/auth/login/custom-config-file/script
@@ -0,0 +1,39 @@
+sethome "./home"
+
+# Use a fake browser that performs a GET on the authorization URL
+# and follows the redirect back to localhost.
+export BROWSER="browser.py"
+
+# Set custom config file location via env var
+export DATABRICKS_CONFIG_FILE="./home/custom.databrickscfg"
+
+# Create an existing custom config file with a DIFFERENT host.
+# The login command should use the host from --host argument, NOT from this file.
+# If the wrong host (from the config file) were used, the OAuth flow would fail
+# because the mock server only responds for $DATABRICKS_HOST.
+cat > "./home/custom.databrickscfg" <<EOF
+[custom-test]
+host = https://old-host.cloud.databricks.com
+auth_type = pat
+token = old-token-123
+EOF
+
+title "Initial custom config file (with old host)\n"
+cat "./home/custom.databrickscfg"
+
+title "Login with new host (should override old host)"
+trace $CLI auth login --host $DATABRICKS_HOST --profile custom-test
+
+title "Default config file should NOT exist\n"
+if [ -f "./home/.databrickscfg" ]; then
+    echo "ERROR: Default .databrickscfg exists but should not"
+    cat "./home/.databrickscfg"
+else
+    echo "OK: Default .databrickscfg does not exist"
+fi
+
+title "Custom config file after login (old host should be replaced)\n"
+cat "./home/custom.databrickscfg"
+
+# Track the custom config file to surface changes
+mv "./home/custom.databrickscfg" "./out.databrickscfg"
diff --git a/acceptance/cmd/auth/login/custom-config-file/test.toml b/acceptance/cmd/auth/login/custom-config-file/test.toml
new file mode 100644
index 0000000000..36c0e7e237
--- /dev/null
+++ b/acceptance/cmd/auth/login/custom-config-file/test.toml
@@ -0,0 +1,3 @@
+Ignore = [
+    "home"
+]
diff --git a/acceptance/cmd/auth/login/host-arg-overrides-profile/out.databrickscfg b/acceptance/cmd/auth/login/host-arg-overrides-profile/out.databrickscfg
new file mode 100644
index 0000000000..0b20cb5f03
--- /dev/null
+++ b/acceptance/cmd/auth/login/host-arg-overrides-profile/out.databrickscfg
@@ -0,0 +1,6 @@
+; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
+[DEFAULT]
+
+[override-test]
+host      = [DATABRICKS_URL]
+auth_type = databricks-cli
diff --git a/acceptance/cmd/auth/login/host-arg-overrides-profile/out.test.toml b/acceptance/cmd/auth/login/host-arg-overrides-profile/out.test.toml
new file mode 100644
index 0000000000..d560f1de04
--- /dev/null
+++ b/acceptance/cmd/auth/login/host-arg-overrides-profile/out.test.toml
@@ -0,0 +1,5 @@
+Local = true
+Cloud = false
+
+[EnvMatrix]
+  DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/login/host-arg-overrides-profile/output.txt b/acceptance/cmd/auth/login/host-arg-overrides-profile/output.txt
new file mode 100644
index 0000000000..b13e876dd0
--- /dev/null
+++ b/acceptance/cmd/auth/login/host-arg-overrides-profile/output.txt
@@ -0,0 +1,16 @@
+
+=== Initial profile with old host
+[override-test]
+host = https://old-host.cloud.databricks.com
+
+=== Login with positional host argument (should override profile)
+>>> [CLI] auth login [DATABRICKS_URL] --profile override-test
+Profile override-test was successfully saved
+
+=== Profile after login (host should be updated)
+; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
+[DEFAULT]
+
+[override-test]
+host      = [DATABRICKS_URL]
+auth_type = databricks-cli
diff --git a/acceptance/cmd/auth/login/host-arg-overrides-profile/script b/acceptance/cmd/auth/login/host-arg-overrides-profile/script
new file mode 100644
index 0000000000..8d3cc68ae4
--- /dev/null
+++ b/acceptance/cmd/auth/login/host-arg-overrides-profile/script
@@ -0,0 +1,25 @@
+sethome "./home"
+
+# Create an existing profile with a DIFFERENT host
+cat > "./home/.databrickscfg" <<EOF
+[override-test]
+host = https://old-host.cloud.databricks.com
+EOF
+
+title "Initial profile with old host\n"
+cat "./home/.databrickscfg"
+
+# Use a fake browser that performs a GET on the authorization URL
+# and follows the redirect back to localhost.
+export BROWSER="browser.py"
+
+# Login with profile but provide a different host as positional argument
+# The positional argument should override the profile's host
+title "Login with positional host argument (should override profile)"
+trace $CLI auth login $DATABRICKS_HOST --profile override-test
+
+title "Profile after login (host should be updated)\n"
+cat "./home/.databrickscfg"
+
+# Track the .databrickscfg file that was created to surface changes.
+mv "./home/.databrickscfg" "./out.databrickscfg"
diff --git a/acceptance/cmd/auth/login/host-arg-overrides-profile/test.toml b/acceptance/cmd/auth/login/host-arg-overrides-profile/test.toml
new file mode 100644
index 0000000000..36c0e7e237
--- /dev/null
+++ b/acceptance/cmd/auth/login/host-arg-overrides-profile/test.toml
@@ -0,0 +1,3 @@
+Ignore = [
+    "home"
+]
diff --git a/acceptance/cmd/auth/login/host-from-profile/out.databrickscfg b/acceptance/cmd/auth/login/host-from-profile/out.databrickscfg
new file mode 100644
index 0000000000..5b725bca90
--- /dev/null
+++ b/acceptance/cmd/auth/login/host-from-profile/out.databrickscfg
@@ -0,0 +1,6 @@
+; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
+[DEFAULT]
+
+[existing-profile]
+host      = [DATABRICKS_URL]
+auth_type = databricks-cli
diff --git a/acceptance/cmd/auth/login/host-from-profile/out.test.toml b/acceptance/cmd/auth/login/host-from-profile/out.test.toml
new file mode 100644
index 0000000000..d560f1de04
--- /dev/null
+++ b/acceptance/cmd/auth/login/host-from-profile/out.test.toml
@@ -0,0 +1,5 @@
+Local = true
+Cloud = false
+
+[EnvMatrix]
+  DATABRICKS_BUNDLE_ENGINE = ["terraform", "direct"]
diff --git a/acceptance/cmd/auth/login/host-from-profile/output.txt b/acceptance/cmd/auth/login/host-from-profile/output.txt
new file mode 100644
index 0000000000..5683c925bf
--- /dev/null
+++ b/acceptance/cmd/auth/login/host-from-profile/output.txt
@@ -0,0 +1,16 @@
+
+=== Initial profile
+[existing-profile]
+host = [DATABRICKS_URL]
+
+=== Login with existing profile (no host argument)
+>>> [CLI] auth login --profile existing-profile
+Profile existing-profile was successfully saved
+
+=== Profile after login
+; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
+[DEFAULT]
+
+[existing-profile]
+host      = [DATABRICKS_URL]
+auth_type = databricks-cli
diff --git a/acceptance/cmd/auth/login/host-from-profile/script b/acceptance/cmd/auth/login/host-from-profile/script
new file mode 100644
index 0000000000..9f44e4a705
--- /dev/null
+++ b/acceptance/cmd/auth/login/host-from-profile/script
@@ -0,0 +1,24 @@
+sethome "./home"
+
+# Create an existing profile with a host
+cat > "./home/.databrickscfg" <<EOF
+[existing-profile]
+host = $DATABRICKS_HOST
+EOF
+
+title "Initial profile\n"
+cat "./home/.databrickscfg"
+
+# Use a fake browser that performs a GET on the authorization URL
+# and follows the redirect back to localhost.
+export BROWSER="browser.py"
+
+# Login with just the profile name - should use the host from the profile
+title "Login with existing profile (no host argument)"
+trace $CLI auth login --profile existing-profile
+
+title "Profile after login\n"
+cat "./home/.databrickscfg"
+
+# Track the .databrickscfg file that was created to surface changes.
+mv "./home/.databrickscfg" "./out.databrickscfg"
diff --git a/acceptance/cmd/auth/login/host-from-profile/test.toml b/acceptance/cmd/auth/login/host-from-profile/test.toml
new file mode 100644
index 0000000000..36c0e7e237
--- /dev/null
+++ b/acceptance/cmd/auth/login/host-from-profile/test.toml
@@ -0,0 +1,3 @@
+Ignore = [
+    "home"
+]
diff --git a/cmd/auth/login.go b/cmd/auth/login.go
index 733c404e33..4173deb0d6 100644
--- a/cmd/auth/login.go
+++ b/cmd/auth/login.go
@@ -19,6 +19,7 @@ import (
 	"github.com/databricks/cli/libs/exec"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/config"
+	"github.com/databricks/databricks-sdk-go/config/experimental/auth/authconv"
 	"github.com/databricks/databricks-sdk-go/credentials/u2m"
 	browserpkg "github.com/pkg/browser"
 	"github.com/spf13/cobra"
@@ -152,40 +153,38 @@ depends on the existing profiles you have set in your configuration file
 		}
 		defer persistentAuth.Close()
 
-		// We need the config without the profile before it's used to initialise new workspace client below.
-		// Otherwise it will complain about non existing profile because it was not yet saved.
-		cfg := config.Config{
-			Host:      authArguments.Host,
-			AccountID: authArguments.AccountID,
-			AuthType:  "databricks-cli",
-		}
-		databricksCfgFile := os.Getenv("DATABRICKS_CONFIG_FILE")
-		if databricksCfgFile != "" {
-			cfg.ConfigFile = databricksCfgFile
-		}
-
 		ctx, cancel := context.WithTimeout(ctx, loginTimeout)
 		defer cancel()
 
 		if err = persistentAuth.Challenge(); err != nil {
 			return err
 		}
+		// At this point, an OAuth token has been successfully minted and stored
+		// in the CLI cache. The rest of the command focuses on:
+		// 1. Configuring cluster and serverless;
+		// 2. Saving the profile.
 
+		var clusterID, serverlessComputeID string
 		switch {
 		case configureCluster:
-			w, err := databricks.NewWorkspaceClient((*databricks.Config)(&cfg))
+			// Create a workspace client to list clusters for interactive selection.
+			// We use a custom CredentialsStrategy that wraps the token we just minted,
+			// avoiding the need to spawn a child CLI process (which AuthType "databricks-cli" does).
+			w, err := databricks.NewWorkspaceClient(&databricks.Config{
+				Host:        authArguments.Host,
+				AccountID:   authArguments.AccountID,
+				Credentials: config.NewTokenSourceStrategy("login-token", authconv.AuthTokenSource(persistentAuth)),
+			})
 			if err != nil {
 				return err
 			}
-			clusterID, err := cfgpickers.AskForCluster(ctx, w,
+			clusterID, err = cfgpickers.AskForCluster(ctx, w,
 				cfgpickers.WithDatabricksConnect(minimalDbConnectVersion))
 			if err != nil {
 				return err
 			}
-			cfg.ClusterID = clusterID
 		case configureServerless:
-			cfg.ClusterID = ""
-			cfg.ServerlessComputeID = "auto"
+			serverlessComputeID = "auto"
 		default:
 			// Respect the existing profile if it exists, even if it has
 			// both cluster and serverless configured. Tools relying on
@@ -195,20 +194,20 @@ depends on the existing profiles you have set in your configuration file
 			// to clean up the profile under the assumption that serverless
 			// is the preferred option.
 			if existingProfile != nil {
-				cfg.ClusterID = existingProfile.ClusterID
-				cfg.ServerlessComputeID = existingProfile.ServerlessComputeID
+				clusterID = existingProfile.ClusterID
+				serverlessComputeID = existingProfile.ServerlessComputeID
 			}
 		}
 
 		if profileName != "" {
 			err = databrickscfg.SaveToProfile(ctx, &config.Config{
 				Profile:             profileName,
-				Host:                cfg.Host,
-				AuthType:            cfg.AuthType,
-				AccountID:           cfg.AccountID,
-				ClusterID:           cfg.ClusterID,
-				ConfigFile:          cfg.ConfigFile,
-				ServerlessComputeID: cfg.ServerlessComputeID,
+				Host:                authArguments.Host,
+				AuthType:            "databricks-cli",
+				AccountID:           authArguments.AccountID,
+				ClusterID:           clusterID,
+				ConfigFile:          os.Getenv("DATABRICKS_CONFIG_FILE"),
+				ServerlessComputeID: serverlessComputeID,
 			})
 			if err != nil {
 				return err