diff --git a/pom.xml b/pom.xml
index e2b962a81..e9972db1f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -71,10 +71,16 @@
             <dependency>
                 <groupId>io.jenkins.tools.bom</groupId>
                 <artifactId>bom-${jenkins.baseline}.x</artifactId>
-                <version>5543.vfd758c7c868d</version>
+                <version>5804.v80587a_38d937</version>
                 <scope>import</scope>
                 <type>pom</type>
             </dependency>
+            <!-- TODO until in BOM -->
+            <dependency>
+                <groupId>org.jenkins-ci.plugins</groupId>
+                <artifactId>credentials</artifactId>
+                <version>1480.v2246fd131e83</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
     <dependencies>
diff --git a/src/main/java/com/cloudbees/jenkins/plugins/bitbucket/filesystem/BitbucketSCMFileSystem.java b/src/main/java/com/cloudbees/jenkins/plugins/bitbucket/filesystem/BitbucketSCMFileSystem.java
index d1baa55e1..e156f607f 100644
--- a/src/main/java/com/cloudbees/jenkins/plugins/bitbucket/filesystem/BitbucketSCMFileSystem.java
+++ b/src/main/java/com/cloudbees/jenkins/plugins/bitbucket/filesystem/BitbucketSCMFileSystem.java
@@ -33,7 +33,6 @@
 import com.cloudbees.jenkins.plugins.bitbucket.api.BitbucketCommit;
 import com.cloudbees.jenkins.plugins.bitbucket.impl.util.BitbucketApiUtils;
 import com.cloudbees.jenkins.plugins.bitbucket.impl.util.DateUtils;
-import com.cloudbees.plugins.credentials.CredentialsMatchers;
 import com.cloudbees.plugins.credentials.CredentialsProvider;
 import com.cloudbees.plugins.credentials.common.StandardCredentials;
 import com.cloudbees.plugins.credentials.domains.URIRequirementBuilder;
@@ -234,20 +233,16 @@ private static StandardCredentials lookupScanCredentials(@CheckForNull Item cont
             if (scanCredentialsId == null) {
                 return null;
             } else {
-                return CredentialsMatchers.firstOrNull(
-                        CredentialsProvider.lookupCredentialsInItem(
+                var c = CredentialsProvider.findCredentialByIdInItem(
+                                scanCredentialsId,
                                 StandardCredentials.class,
                                 context,
                                 context instanceof Queue.Task task
                                         ? task.getDefaultAuthentication2()
                                         : ACL.SYSTEM2,
                                 URIRequirementBuilder.fromUri(serverURL).build()
-                        ),
-                        CredentialsMatchers.allOf(
-                                CredentialsMatchers.withId(scanCredentialsId),
-                                AuthenticationTokens.matcher(BitbucketAuthenticator.authenticationContext(serverURL))
-                        )
                 );
+                return c != null && AuthenticationTokens.matcher(BitbucketAuthenticator.authenticationContext(serverURL)).matches(c) ? c : null;
             }
         }
 
diff --git a/src/main/java/com/cloudbees/jenkins/plugins/bitbucket/util/BitbucketCredentialsUtils.java b/src/main/java/com/cloudbees/jenkins/plugins/bitbucket/util/BitbucketCredentialsUtils.java
index a19fea1b0..36d6c77a5 100644
--- a/src/main/java/com/cloudbees/jenkins/plugins/bitbucket/util/BitbucketCredentialsUtils.java
+++ b/src/main/java/com/cloudbees/jenkins/plugins/bitbucket/util/BitbucketCredentialsUtils.java
@@ -141,14 +141,13 @@ public static <T extends StandardCredentials> T lookupCredentials(@CheckForNull
                     : ACL.SYSTEM2;
             List<DomainRequirement> domainRequirements = URIRequirementBuilder.fromUri(serverURL).build();
 
-            return CredentialsMatchers.firstOrNull(
-                    CredentialsProvider.lookupCredentialsInItem(
+            return CredentialsProvider.findCredentialByIdInItem(
+                            credentialsId,
                             type,
                             item,
                             authentication,
                             domainRequirements
-                    ),
-                    CredentialsMatchers.withId(credentialsId));
+                    );
         }
         return null;
     }
@@ -161,13 +160,12 @@ public static <T extends StandardCredentials> T lookupCredentials(@CheckForNull
         if (StringUtils.isNotBlank(credentialsId)) {
             List<DomainRequirement> domainRequirements = URIRequirementBuilder.fromUri(serverURL).build();
 
-            return CredentialsMatchers.firstOrNull(
-                    CredentialsProvider.lookupCredentialsInItemGroup(
+            return CredentialsProvider.findCredentialByIdInItemGroup(
+                            credentialsId,
                             type,
                             itemGroup,
                             null,
-                            domainRequirements),
-                    CredentialsMatchers.withId(credentialsId));
+                            domainRequirements);
         }
         return null;
     }
@@ -188,13 +186,12 @@ public static FormValidation checkCredentialsId(@CheckForNull SCMSourceOwner con
                     : ACL.SYSTEM2;
             List<DomainRequirement> domainRequirements = URIRequirementBuilder.fromUri(serverURL).build();
 
-            StandardCertificateCredentials certificateCredentials = CredentialsMatchers.firstOrNull(
-                    CredentialsProvider.lookupCredentialsInItem(
+            StandardCertificateCredentials certificateCredentials = CredentialsProvider.findCredentialByIdInItem(
+                            credentialsId,
                             StandardCertificateCredentials.class,
                             context,
                             authentication,
-                            domainRequirements),
-                    CredentialsMatchers.withId(credentialsId));
+                            domainRequirements);
             if (certificateCredentials != null) {
                 return FormValidation.warning("A certificate was selected. You will likely need to configure Checkout over SSH.");
             }