diff --git a/pom.xml b/pom.xml
index cd115e5525..a999eb9680 100644
--- a/pom.xml
+++ b/pom.xml
@@ -57,6 +57,12 @@
         <type>pom</type>
         <scope>import</scope>
       </dependency>
+      <!-- TODO until in BOM -->
+      <dependency>
+        <groupId>org.jenkins-ci.plugins</groupId>
+        <artifactId>credentials</artifactId>
+        <version>1480.v2246fd131e83</version>
+      </dependency>
     </dependencies>
   </dependencyManagement>
   <dependencies>
diff --git a/src/main/java/hudson/plugins/git/UserRemoteConfig.java b/src/main/java/hudson/plugins/git/UserRemoteConfig.java
index 1248170886..ba1d869f0a 100644
--- a/src/main/java/hudson/plugins/git/UserRemoteConfig.java
+++ b/src/main/java/hudson/plugins/git/UserRemoteConfig.java
@@ -1,6 +1,5 @@
 package hudson.plugins.git;
 
-import com.cloudbees.plugins.credentials.CredentialsMatchers;
 import com.cloudbees.plugins.credentials.CredentialsProvider;
 import com.cloudbees.plugins.credentials.common.StandardCredentials;
 import com.cloudbees.plugins.credentials.common.StandardListBoxModel;
@@ -268,10 +267,12 @@ public FormValidation doCheckRefspec(@QueryParameter String name,
         }
 
         private static StandardCredentials lookupCredentials(@CheckForNull Item project, String credentialId, String uri) {
-            return (credentialId == null) ? null : CredentialsMatchers.firstOrNull(
-                        CredentialsProvider.lookupCredentialsInItem(StandardCredentials.class, project, ACL.SYSTEM2,
-                                GitURIRequirementsBuilder.fromUri(uri).build()),
-                        CredentialsMatchers.withId(credentialId));
+            return (credentialId == null) ? null : CredentialsProvider.findCredentialByIdInItem(
+                    credentialId,
+                    StandardCredentials.class,
+                    project,
+                    ACL.SYSTEM2,
+                    GitURIRequirementsBuilder.fromUri(uri).build());
         }
 
         @Override
diff --git a/src/main/java/jenkins/plugins/git/AbstractGitSCMSource.java b/src/main/java/jenkins/plugins/git/AbstractGitSCMSource.java
index 1504297965..b4a9c7873b 100644
--- a/src/main/java/jenkins/plugins/git/AbstractGitSCMSource.java
+++ b/src/main/java/jenkins/plugins/git/AbstractGitSCMSource.java
@@ -23,7 +23,6 @@
  */
 package jenkins.plugins.git;
 
-import com.cloudbees.plugins.credentials.CredentialsMatchers;
 import com.cloudbees.plugins.credentials.CredentialsNameProvider;
 import com.cloudbees.plugins.credentials.CredentialsProvider;
 import com.cloudbees.plugins.credentials.common.StandardCredentials;
@@ -1330,12 +1329,13 @@ private StandardUsernameCredentials getCredentials(@CheckForNull Item context) {
         if (credentialsId == null) {
             return null;
         }
-        return CredentialsMatchers
-                .firstOrNull(
-                        CredentialsProvider.lookupCredentialsInItem(StandardUsernameCredentials.class, context,
-                                ACL.SYSTEM2, URIRequirementBuilder.fromUri(getRemote()).build()),
-                        CredentialsMatchers.allOf(CredentialsMatchers.withId(credentialsId),
-                                GitClient.CREDENTIALS_MATCHER));
+        var credential = CredentialsProvider.findCredentialByIdInItem(
+                credentialsId,
+                StandardUsernameCredentials.class,
+                context,
+                ACL.SYSTEM2,
+                URIRequirementBuilder.fromUri(getRemote()).build());
+        return credential != null && GitClient.CREDENTIALS_MATCHER.matches(credential) ? credential : null;
     }
 
     /**
diff --git a/src/main/java/jenkins/plugins/git/GitSCMFileSystem.java b/src/main/java/jenkins/plugins/git/GitSCMFileSystem.java
index bb5cb13710..2165734450 100644
--- a/src/main/java/jenkins/plugins/git/GitSCMFileSystem.java
+++ b/src/main/java/jenkins/plugins/git/GitSCMFileSystem.java
@@ -25,7 +25,6 @@
 
 package jenkins.plugins.git;
 
-import com.cloudbees.plugins.credentials.CredentialsMatchers;
 import com.cloudbees.plugins.credentials.CredentialsProvider;
 import com.cloudbees.plugins.credentials.common.StandardCredentials;
 import com.cloudbees.plugins.credentials.common.StandardUsernameCredentials;
@@ -369,20 +368,17 @@ public SCMFileSystem build(@NonNull Item owner, @NonNull SCM scm, @CheckForNull
                 GitClient client = git.getClient();
                 String credentialsId = config.getCredentialsId();
                 if (credentialsId != null) {
-                    StandardCredentials credential = CredentialsMatchers.firstOrNull(
-                            CredentialsProvider.lookupCredentialsInItem(
-                                StandardUsernameCredentials.class,
-                                owner,
-                                ACL.SYSTEM2,
-                                URIRequirementBuilder.fromUri(remote).build()
-                            ),
-                            CredentialsMatchers.allOf(
-                                CredentialsMatchers.withId(credentialsId),
-                                GitClient.CREDENTIALS_MATCHER
-                            )
-                        );
-                    client.addDefaultCredentials(credential);
-                    CredentialsProvider.track(owner, credential);
+                    var credential = CredentialsProvider.findCredentialByIdInItem(
+                            credentialsId,
+                            StandardUsernameCredentials.class,
+                            owner,
+                            ACL.SYSTEM2,
+                            URIRequirementBuilder.fromUri(remote).build());
+                    StandardCredentials matchedCredential = credential != null && GitClient.CREDENTIALS_MATCHER.matches(credential)
+                            ? credential
+                            : null;
+                    client.addDefaultCredentials(matchedCredential);
+                    CredentialsProvider.track(owner, matchedCredential);
                 }
 
                 if (!client.hasGitRepo(false)) {
diff --git a/src/main/java/jenkins/plugins/git/GitSCMTelescope.java b/src/main/java/jenkins/plugins/git/GitSCMTelescope.java
index 59057b7c6b..ebd9ab1c97 100644
--- a/src/main/java/jenkins/plugins/git/GitSCMTelescope.java
+++ b/src/main/java/jenkins/plugins/git/GitSCMTelescope.java
@@ -25,7 +25,6 @@
 
 package jenkins.plugins.git;
 
-import com.cloudbees.plugins.credentials.CredentialsMatchers;
 import com.cloudbees.plugins.credentials.CredentialsProvider;
 import com.cloudbees.plugins.credentials.common.StandardCredentials;
 import com.cloudbees.plugins.credentials.common.StandardUsernameCredentials;
@@ -189,16 +188,17 @@ public final SCMFileSystem build(@NonNull Item owner, @NonNull SCM scm, SCMRevis
                     StandardCredentials credentials;
                     String credentialsId = config.getCredentialsId();
                     if (credentialsId != null) {
-                        List<StandardUsernameCredentials> urlCredentials = CredentialsProvider
-                                .lookupCredentialsInItem(StandardUsernameCredentials.class, owner,
-                                        owner instanceof Queue.Task t
-                                                ? Tasks.getAuthenticationOf2(t)
-                                                : ACL.SYSTEM2, URIRequirementBuilder.fromUri(remote).build());
-                        credentials = CredentialsMatchers.firstOrNull(
-                                urlCredentials,
-                                CredentialsMatchers
-                                        .allOf(CredentialsMatchers.withId(credentialsId), GitClient.CREDENTIALS_MATCHER)
-                        );
+                        var credential = CredentialsProvider.findCredentialByIdInItem(
+                                credentialsId,
+                                StandardUsernameCredentials.class,
+                                owner,
+                                owner instanceof Queue.Task t
+                                        ? Tasks.getAuthenticationOf2(t)
+                                        : ACL.SYSTEM2,
+                                URIRequirementBuilder.fromUri(remote).build());
+                        credentials = credential != null && GitClient.CREDENTIALS_MATCHER.matches(credential)
+                                ? credential
+                                : null;
                     } else {
                         credentials = null;
                     }