diff --git a/registry/remote/credentials/file_store_test.go b/registry/remote/credentials/file_store_test.go
index 3170867a..dccb7d05 100644
--- a/registry/remote/credentials/file_store_test.go
+++ b/registry/remote/credentials/file_store_test.go
@@ -228,7 +228,7 @@ func TestFileStore_Get_invalidConfig(t *testing.T) {
 	}
 }
 
-func TestReadOnlyFileStore_Get_emptyConfig(t *testing.T) {
+func TestFileStore_Get_emptyConfig(t *testing.T) {
 	ctx := context.Background()
 	fs, err := NewFileStore("testdata/empty_config.json")
 	if err != nil {
diff --git a/registry/remote/credentials/readonly_file_store.go b/registry/remote/credentials/readonly_file_store.go
index b36dcee2..525d7f3b 100644
--- a/registry/remote/credentials/readonly_file_store.go
+++ b/registry/remote/credentials/readonly_file_store.go
@@ -50,13 +50,3 @@ func NewReadOnlyFileStore(reader io.Reader) (*ReadOnlyFileStore, error) {
 func (fs *ReadOnlyFileStore) Get(_ context.Context, serverAddress string) (auth.Credential, error) {
 	return fs.cfg.GetCredential(serverAddress)
 }
-
-// Get always returns ErrReadOnlyStore. It's present to satisfy the Store interface.
-func (fs *ReadOnlyFileStore) Put(_ context.Context, _ string, _ auth.Credential) error {
-	return ErrReadOnlyStore
-}
-
-// Delete always returns ErrReadOnlyStore. It's present to satisfy the Store interface.
-func (fs *ReadOnlyFileStore) Delete(_ context.Context, _ string) error {
-	return ErrReadOnlyStore
-}
diff --git a/registry/remote/credentials/readonly_file_store_test.go b/registry/remote/credentials/readonly_file_store_test.go
index 56e7ac73..acf085e4 100644
--- a/registry/remote/credentials/readonly_file_store_test.go
+++ b/registry/remote/credentials/readonly_file_store_test.go
@@ -134,7 +134,7 @@ func TestReadOnlyFileStore_Create_fromInvalidConfig(t *testing.T) {
 	}
 }
 
-func TestFileStore_Get_emptyConfig(t *testing.T) {
+func TestReadOnlyFileStore_Get_emptyConfig(t *testing.T) {
 	ctx := context.Background()
 	const emptyValidJson = "{}"
 	rofs, err := NewReadOnlyFileStore(strings.NewReader(emptyValidJson))
diff --git a/registry/remote/credentials/registry.go b/registry/remote/credentials/registry.go
index 39735b77..e6c35fad 100644
--- a/registry/remote/credentials/registry.go
+++ b/registry/remote/credentials/registry.go
@@ -69,7 +69,7 @@ func Logout(ctx context.Context, store Store, registryName string) error {
 }
 
 // Credential returns a Credential() function that can be used by auth.Client.
-func Credential(store Store) auth.CredentialFunc {
+func Credential(store ReadOnlyStore) auth.CredentialFunc {
 	return func(ctx context.Context, hostport string) (auth.Credential, error) {
 		hostport = ServerAddressFromHostname(hostport)
 		if hostport == "" {
diff --git a/registry/remote/credentials/store.go b/registry/remote/credentials/store.go
index e26a98ae..59bb03f6 100644
--- a/registry/remote/credentials/store.go
+++ b/registry/remote/credentials/store.go
@@ -37,10 +37,15 @@ const (
 	dockerConfigFileName = "config.json"
 )
 
-// Store is the interface that any credentials store must implement.
-type Store interface {
+// ReadOnlyStore is a read-only interface for credentials store.
+type ReadOnlyStore interface {
 	// Get retrieves credentials from the store for the given server address.
 	Get(ctx context.Context, serverAddress string) (auth.Credential, error)
+}
+
+// Store is the interface that any credentials store must implement.
+type Store interface {
+	ReadOnlyStore
 	// Put saves credentials into the store for the given server address.
 	Put(ctx context.Context, serverAddress string, cred auth.Credential) error
 	// Delete removes credentials from the store for the given server address.