diff --git a/src/main/java/com/cloudogu/gitops/application/content/ContentLoader.java b/src/main/java/com/cloudogu/gitops/application/content/ContentLoader.java
index cc338c781..166ba80d0 100644
--- a/src/main/java/com/cloudogu/gitops/application/content/ContentLoader.java
+++ b/src/main/java/com/cloudogu/gitops/application/content/ContentLoader.java
@@ -313,7 +313,7 @@ private static String firstNonBlank(String preferred, String fallback) {
 	private static boolean referenceHasSecretLocation(Credentials reference) {
 		return reference != null
 			&& ((reference.getSecretName() != null && !reference.getSecretName().isEmpty())
-				|| (reference.getSecretNamespace() != null && !reference.getSecretNamespace().isEmpty()));
+			|| (reference.getSecretNamespace() != null && !reference.getSecretNamespace().isEmpty()));
 	}
 
 	void createContentRepos() throws Exception {
@@ -574,7 +574,7 @@ private void cloneToLocalFolder(
 			}
 
 			if (repoConfig.getRef() != null && !repoConfig.getRef().isEmpty()) {
-				String actualRef = findRef(repoConfig, git.getRepository());
+				String actualRef = findRef(repoConfig, git.getRepository(), credentialsProvider);
 				git.checkout().setName(actualRef).call();
 			}
 		} catch (RuntimeException e) {
@@ -584,7 +584,9 @@ private void cloneToLocalFolder(
 		}
 	}
 
-	private static String findRef(ContentRepositorySchema repoConfig, Repository gitRepo) {
+	private static String findRef(
+		ContentRepositorySchema repoConfig, Repository gitRepo,
+		UsernamePasswordCredentialsProvider credentialsProvider) {
 		try {
 			if (gitRepo.resolve(repoConfig.getRef()) != null) {
 				return repoConfig.getRef();
@@ -595,6 +597,9 @@ private static String findRef(ContentRepositorySchema repoConfig, Repository git
 											   .setHeads(true)
 											   .setTags(true);
 
+
+			remoteCommand.setCredentialsProvider(credentialsProvider);
+
 			Collection<Ref> refs = remoteCommand.call();
 			String potentialRef = null;
 			for (Ref ref : refs) {