diff --git a/autoenv.zsh b/autoenv.zsh
index c710389..14e8159 100644
--- a/autoenv.zsh
+++ b/autoenv.zsh
@@ -154,8 +154,8 @@ _autoenv_authorize() {
 
 _autoenv_deauthorize() {
   local env_file=$1
-  if [[ -f $AUTOENV_ENV_FILENAME ]]; then
-    echo $(\grep -vF $env_file $AUTOENV_ENV_FILENAME) > $AUTOENV_ENV_FILENAME
+  if [[ -s $AUTOENV_ENV_FILENAME ]]; then
+    echo "$(\grep -vF $env_file $AUTOENV_ENV_FILENAME)" > $AUTOENV_ENV_FILENAME
   fi
 }
 
diff --git a/tests/.zshenv b/tests/.zshenv
index 2311e2a..029e73d 100644
--- a/tests/.zshenv
+++ b/tests/.zshenv
@@ -4,3 +4,5 @@ AUTOENV_DEBUG=0
 
 source "$TESTDIR/../autoenv.plugin.zsh"
 export AUTOENV_ENV_FILENAME="$PWD/.env_auth"
+
+echo -n > $AUTOENV_ENV_FILENAME
diff --git a/tests/_autoenv_utils.t b/tests/_autoenv_utils.t
index 79c4bf1..c8c4a8c 100644
--- a/tests/_autoenv_utils.t
+++ b/tests/_autoenv_utils.t
@@ -8,8 +8,66 @@ Non-existing entries are allowed and handled without error.
   $ touch file sub/file sub/sub2/file
 
 Should not get the file from the current dir.
+
   $ _autoenv_get_file_upwards . file
 
   $ cd sub/sub2
   $ _autoenv_get_file_upwards . file
   */_autoenv_utils.t/sub/file (glob)
+
+
+Tests for _autoenv_authorize. {{{
+
+Auth file is empty.
+
+  $ cd ../..
+  $ cat $AUTOENV_ENV_FILENAME
+
+Failed authorization should keep the auth file empty.
+
+  $ _autoenv_authorize does-not-exist
+  Missing file argument for _autoenv_hash_pair!
+  [1]
+  $ cat $AUTOENV_ENV_FILENAME
+
+Now adding some auth pair.
+
+  $ echo first > first
+  $ _autoenv_authorize first
+  $ cat $AUTOENV_ENV_FILENAME
+  /tmp/cramtests-*/_autoenv_utils.t/first:271ac93c44ac198d92e706c6d6f1d84aefcfa337:1 (glob)
+
+And a second one.
+
+  $ echo second > second
+  $ _autoenv_authorize second
+  $ cat $AUTOENV_ENV_FILENAME
+  /tmp/cramtests-*/_autoenv_utils.t/first:271ac93c44ac198d92e706c6d6f1d84aefcfa337:1 (glob)
+  /tmp/cramtests-*/_autoenv_utils.t/second:7bee8f3b184e1e141ff76efe369c3b8bfc50e64c:1 (glob)
+
+And a third.
+
+  $ echo third > third
+  $ _autoenv_authorize third
+  $ cat $AUTOENV_ENV_FILENAME
+  /tmp/cramtests-*/_autoenv_utils.t/first:271ac93c44ac198d92e706c6d6f1d84aefcfa337:1 (glob)
+  /tmp/cramtests-*/_autoenv_utils.t/second:7bee8f3b184e1e141ff76efe369c3b8bfc50e64c:1 (glob)
+  /tmp/cramtests-*/_autoenv_utils.t/third:ad180453bf8a374a15df3e90a78c180230146a7c:1 (glob)
+
+Re-add the second one, with the same hash.
+
+  $ _autoenv_authorize second
+  $ cat $AUTOENV_ENV_FILENAME
+  /tmp/cramtests-*/_autoenv_utils.t/first:271ac93c44ac198d92e706c6d6f1d84aefcfa337:1 (glob)
+  /tmp/cramtests-*/_autoenv_utils.t/third:ad180453bf8a374a15df3e90a78c180230146a7c:1 (glob)
+  /tmp/cramtests-*/_autoenv_utils.t/second:7bee8f3b184e1e141ff76efe369c3b8bfc50e64c:1 (glob)
+
+Re-add the first one, with a new hash.
+
+  $ echo one more line >> first
+  $ _autoenv_authorize first
+  $ cat $AUTOENV_ENV_FILENAME
+  /tmp/cramtests-*/_autoenv_utils.t/third:ad180453bf8a374a15df3e90a78c180230146a7c:1 (glob)
+  /tmp/cramtests-*/_autoenv_utils.t/second:7bee8f3b184e1e141ff76efe369c3b8bfc50e64c:1 (glob)
+  /tmp/cramtests-*/_autoenv_utils.t/first:65eb010197b73ddc109b7210080f97a87f53451e:1 (glob)
+}}}