diff --git a/src/main/java/org/jenkinsci/plugins/gitclient/CliGitAPIImpl.java b/src/main/java/org/jenkinsci/plugins/gitclient/CliGitAPIImpl.java
index 1f1959135f..9152be923c 100644
--- a/src/main/java/org/jenkinsci/plugins/gitclient/CliGitAPIImpl.java
+++ b/src/main/java/org/jenkinsci/plugins/gitclient/CliGitAPIImpl.java
@@ -194,7 +194,6 @@ public class CliGitAPIImpl extends LegacyCompatibleGitAPIImpl {
     EnvVars environment;
     private Map<String, StandardCredentials> credentials = new HashMap<>();
     private StandardCredentials defaultCredentials;
-    private StandardCredentials lfsCredentials;
     private final String encoding;
 
     /* If we fail some helper tool (e.g. SELinux chcon) do not make noise
@@ -674,10 +673,7 @@ public void fetch(String remoteName, RefSpec... refspec) throws GitException, In
             }
         }
 
-        StandardCredentials cred = credentials.get(url);
-        if (cred == null) {
-            cred = defaultCredentials;
-        }
+        StandardCredentials cred = getCredentials(url);
         launchCommandWithCredentials(args, workspace, cred, url);
     }
 
@@ -3175,23 +3171,49 @@ public void execute() throws GitException, InterruptedException {
                         args.add("-f");
                     }
                     args.add(ref);
-                    launchCommandIn(args, workspace, checkoutEnv, timeout);
+
+                    StandardCredentials cred = null;
+                    String checkoutUrl = null;
+                    if (isAtLeastVersion(2, 27, 0, 0)) {
+                        String result = firstLine(launchCommand(
+                                "config", "--get", "--default", "''", "remote.origin.partialclonefilter"));
+                        if (result != null && !result.isBlank()) {
+                            checkoutUrl = launchCommand("config", "--get", "--default", "''", "remote.origin.url")
+                                    .trim(); // TODO: how to get the url correctly (and compatible with the
+                            // unit tests)?
+                            // checkoutUrl = getRemoteUrl("origin"); // fails with unit tests
+                            if (checkoutUrl.isBlank()) {
+                                checkoutUrl = null;
+                            } else {
+                                cred = getCredentials(checkoutUrl);
+                            }
+                        }
+                    }
+
+                    if (checkoutUrl != null) {
+                        try {
+                            // credentials are needed for instance for blobless clone and are simply not used in
+                            // "standard" cases
+                            launchCommandWithCredentials(args, workspace, cred, new URIish(checkoutUrl), timeout);
+                        } catch (URISyntaxException e) {
+                            throw new GitException("Invalid URL " + checkoutUrl, e);
+                        }
+                    } else {
+                        launchCommandIn(args, workspace, checkoutEnv, timeout);
+                    }
 
                     if (lfsRemote != null) {
                         final String url = getRemoteUrl(lfsRemote);
-                        StandardCredentials cred = lfsCredentials;
-                        if (cred == null) {
-                            cred = credentials.get(url);
-                        }
-                        if (cred == null) {
-                            cred = defaultCredentials;
+                        StandardCredentials lfsCred = lfsCredentials;
+                        if (lfsCred == null) {
+                            lfsCred = getCredentials(url);
                         }
                         ArgumentListBuilder lfsArgs = new ArgumentListBuilder();
                         lfsArgs.add("lfs");
                         lfsArgs.add("pull");
                         lfsArgs.add(lfsRemote);
                         try {
-                            launchCommandWithCredentials(lfsArgs, workspace, cred, new URIish(url), timeout);
+                            launchCommandWithCredentials(lfsArgs, workspace, lfsCred, new URIish(url), timeout);
                         } catch (URISyntaxException e) {
                             throw new GitException("Invalid URL " + url, e);
                         }
@@ -3738,10 +3760,7 @@ public Map<String, ObjectId> getHeadRev(String url) throws GitException, Interru
         args.add("-h");
         addCheckedRemoteUrl(args, url);
 
-        StandardCredentials cred = credentials.get(url);
-        if (cred == null) {
-            cred = defaultCredentials;
-        }
+        StandardCredentials cred = getCredentials(url);
 
         String result = launchCommandWithCredentials(args, null, cred, url);
 
@@ -3766,10 +3785,7 @@ public ObjectId getHeadRev(String url, String branchSpec) throws GitException, I
             args.add("-h");
         }
 
-        StandardCredentials cred = credentials.get(url);
-        if (cred == null) {
-            cred = defaultCredentials;
-        }
+        StandardCredentials cred = getCredentials(url);
 
         addCheckedRemoteUrl(args, url);
 
@@ -3798,10 +3814,7 @@ public Map<String, ObjectId> getRemoteReferences(String url, String pattern, boo
             args.add(pattern);
         }
 
-        StandardCredentials cred = credentials.get(url);
-        if (cred == null) {
-            cred = defaultCredentials;
-        }
+        StandardCredentials cred = getCredentials(url);
 
         String result = launchCommandWithCredentials(args, null, cred, url);
 
@@ -3841,10 +3854,7 @@ public Map<String, String> getRemoteSymbolicReferences(String url, String patter
                 args.add(pattern);
             }
 
-            StandardCredentials cred = credentials.get(url);
-            if (cred == null) {
-                cred = defaultCredentials;
-            }
+            StandardCredentials cred = getCredentials(url);
 
             String result = launchCommandWithCredentials(args, null, cred, url);
 
@@ -3884,10 +3894,7 @@ public void push(RemoteConfig repository, String refspec) throws GitException, I
         ArgumentListBuilder args = new ArgumentListBuilder();
         URIish uri = repository.getURIs().get(0);
         String url = uri.toPrivateString();
-        StandardCredentials cred = credentials.get(url);
-        if (cred == null) {
-            cred = defaultCredentials;
-        }
+        StandardCredentials cred = getCredentials(url);
 
         args.add("push");
         addCheckedRemoteUrl(args, url);
@@ -3990,6 +3997,14 @@ private static boolean setsidExists() {
         return false;
     }
 
+    private StandardCredentials getCredentials(String url) {
+        StandardCredentials cred = credentials.get(url);
+        if (cred == null) {
+            cred = defaultCredentials;
+        }
+        return cred;
+    }
+
     /** {@inheritDoc} */
     @Override
     public Set<GitObject> getTags() throws GitException, InterruptedException {