diff --git a/pom.xml b/pom.xml
index 3235e2aba..80ef8bff8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -45,10 +45,16 @@
       <dependency>
         <groupId>io.jenkins.tools.bom</groupId>
         <artifactId>bom-${jenkins.baseline}.x</artifactId>
-        <version>5543.vfd758c7c868d</version>
+        <version>5804.v80587a_38d937</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
+      <!-- TODO until in BOM -->
+      <dependency>
+        <groupId>org.jenkins-ci.plugins</groupId>
+        <artifactId>credentials</artifactId>
+        <version>1480.v2246fd131e83</version>
+      </dependency>
     </dependencies>
   </dependencyManagement>
 
diff --git a/src/main/java/org/jenkinsci/plugins/github_branch_source/Connector.java b/src/main/java/org/jenkinsci/plugins/github_branch_source/Connector.java
index d6a30fc14..8a8a52eae 100644
--- a/src/main/java/org/jenkinsci/plugins/github_branch_source/Connector.java
+++ b/src/main/java/org/jenkinsci/plugins/github_branch_source/Connector.java
@@ -27,8 +27,6 @@
 import static java.util.logging.Level.FINE;
 import static java.util.logging.Level.WARNING;
 
-import com.cloudbees.plugins.credentials.CredentialsMatcher;
-import com.cloudbees.plugins.credentials.CredentialsMatchers;
 import com.cloudbees.plugins.credentials.CredentialsNameProvider;
 import com.cloudbees.plugins.credentials.CredentialsProvider;
 import com.cloudbees.plugins.credentials.common.StandardCredentials;
@@ -131,12 +129,11 @@ public static ListBoxModel listScanCredentials(@CheckForNull SCMSourceOwner cont
     public static ListBoxModel listScanCredentials(@CheckForNull Item context, String apiUri) {
         return new StandardListBoxModel()
                 .includeEmptyValue()
-                .includeMatchingAs(
-                        context instanceof Queue.Task ? ((Queue.Task) context).getDefaultAuthentication() : ACL.SYSTEM,
+                .includeAs(
+                        context instanceof Queue.Task t ? t.getDefaultAuthentication2() : ACL.SYSTEM2,
                         context,
-                        StandardUsernameCredentials.class,
-                        githubDomainRequirements(apiUri),
-                        githubScanCredentialsMatcher());
+                        StandardUsernamePasswordCredentials.class,
+                        githubDomainRequirements(apiUri));
     }
 
     /**
@@ -298,16 +295,12 @@ public static StandardCredentials lookupScanCredentials(
         if (Util.fixEmpty(scanCredentialsId) == null) {
             return null;
         }
-        StandardCredentials c = CredentialsMatchers.firstOrNull(
-                CredentialsProvider.lookupCredentialsInItem(
-                        StandardUsernameCredentials.class,
-                        context,
-                        context instanceof Queue.Task
-                                ? ((Queue.Task) context).getDefaultAuthentication2()
-                                : ACL.SYSTEM2,
-                        githubDomainRequirements(apiUri)),
-                CredentialsMatchers.allOf(
-                        CredentialsMatchers.withId(scanCredentialsId), githubScanCredentialsMatcher()));
+        var c = CredentialsProvider.findCredentialByIdInItem(
+                scanCredentialsId,
+                StandardUsernamePasswordCredentials.class,
+                context,
+                context instanceof Queue.Task t ? t.getDefaultAuthentication2() : ACL.SYSTEM2,
+                githubDomainRequirements(apiUri));
         if (c instanceof GitHubAppCredentials && repoOwner != null) {
             // Note: We considered adding an overload so that all existing callers in this plugin could
             // specify an exact repository and granular permission, but decided against it. This method
@@ -334,6 +327,7 @@ public static StandardCredentials lookupScanCredentials(
      * @return the {@link StandardCredentials} or {@code null}
      * @deprecated use {@link #listCheckoutCredentials(Item, String)}
      */
+    @Deprecated
     @NonNull
     public static ListBoxModel listCheckoutCredentials(@CheckForNull SCMSourceOwner context, String apiUri) {
         return listCheckoutCredentials((Item) context, apiUri);
@@ -354,7 +348,7 @@ public static ListBoxModel listCheckoutCredentials(@CheckForNull Item context, S
         result.add("- same as scan credentials -", GitHubSCMSource.DescriptorImpl.SAME);
         result.add("- anonymous -", GitHubSCMSource.DescriptorImpl.ANONYMOUS);
         return result.includeMatchingAs(
-                context instanceof Queue.Task ? ((Queue.Task) context).getDefaultAuthentication() : ACL.SYSTEM,
+                context instanceof Queue.Task t ? t.getDefaultAuthentication2() : ACL.SYSTEM2,
                 context,
                 StandardUsernameCredentials.class,
                 githubDomainRequirements(apiUri),
@@ -521,11 +515,6 @@ public static void release(@CheckForNull GitHub hub) {
         }
     }
 
-    private static CredentialsMatcher githubScanCredentialsMatcher() {
-        // TODO OAuth credentials
-        return CredentialsMatchers.anyOf(CredentialsMatchers.instanceOf(StandardUsernamePasswordCredentials.class));
-    }
-
     static List<DomainRequirement> githubDomainRequirements(String apiUri) {
         return URIRequirementBuilder.fromUri(StringUtils.defaultIfEmpty(apiUri, GitHubServerConfig.GITHUB_URL))
                 .build();
diff --git a/src/main/java/org/jenkinsci/plugins/github_branch_source/GitHubSCMBuilder.java b/src/main/java/org/jenkinsci/plugins/github_branch_source/GitHubSCMBuilder.java
index 962b9707e..39ddb8e1a 100644
--- a/src/main/java/org/jenkinsci/plugins/github_branch_source/GitHubSCMBuilder.java
+++ b/src/main/java/org/jenkinsci/plugins/github_branch_source/GitHubSCMBuilder.java
@@ -25,7 +25,6 @@
 
 import com.cloudbees.jenkins.plugins.sshcredentials.SSHUserPrivateKey;
 import com.cloudbees.plugins.credentials.Credentials;
-import com.cloudbees.plugins.credentials.CredentialsMatchers;
 import com.cloudbees.plugins.credentials.CredentialsProvider;
 import com.cloudbees.plugins.credentials.common.IdCredentials;
 import com.cloudbees.plugins.credentials.common.StandardCredentials;
@@ -219,19 +218,14 @@ public static RepositoryUriResolver uriResolver(
         if (credentialsId == null) {
             return HTTPS;
         } else {
-            StandardCredentials credentials = CredentialsMatchers.firstOrNull(
-                    CredentialsProvider.lookupCredentialsInItem(
-                            StandardCredentials.class,
-                            context,
-                            context instanceof Queue.Task
-                                    ? ((Queue.Task) context).getDefaultAuthentication2()
-                                    : ACL.SYSTEM2,
-                            URIRequirementBuilder.create()
-                                    .withHostname(RepositoryUriResolver.hostnameFromApiUri(apiUri))
-                                    .build()),
-                    CredentialsMatchers.allOf(
-                            CredentialsMatchers.withId(credentialsId),
-                            CredentialsMatchers.instanceOf(StandardCredentials.class)));
+            var credentials = CredentialsProvider.findCredentialByIdInItem(
+                    credentialsId,
+                    StandardCredentials.class,
+                    context,
+                    context instanceof Queue.Task t ? t.getDefaultAuthentication2() : ACL.SYSTEM2,
+                    URIRequirementBuilder.create()
+                            .withHostname(RepositoryUriResolver.hostnameFromApiUri(apiUri))
+                            .build());
             if (credentials instanceof SSHUserPrivateKey) {
                 return SSH;
             } else {