diff --git a/agent/credential_pool.py b/agent/credential_pool.py
index 0bc113746c..d5d652ad74 100644
--- a/agent/credential_pool.py
+++ b/agent/credential_pool.py
@@ -1907,7 +1907,7 @@ class CredentialPool:
                     None,
                 )
             else:
-                entry = self.current() or self._select_unlocked(refresh=False)
+                entry = self._current_unlocked() or self._select_unlocked(refresh=False)
             if entry is None:
                 return None
             self._current_id = entry.id
diff --git a/tests/agent/test_credential_pool.py b/tests/agent/test_credential_pool.py
index 4fbe23efe5..f872b5a509 100644
--- a/tests/agent/test_credential_pool.py
+++ b/tests/agent/test_credential_pool.py
@@ -3619,6 +3619,11 @@ class TestCredentialPoolQueryLocking:
         assert pool.resolve_target("cred-1")[1] is not None
         # (env may seed extra singleton entries; just assert ours are present)
         assert {"cred-1", "cred-2"} <= {e.id for e in pool.entries()}
+        # try_refresh_matching's no-hint branch resolves the current entry
+        # while already holding the lock — must use _current_unlocked(), not
+        # current(), or it deadlocks on the non-reentrant lock (found when
+        # rebasing this fix over the #69843 salvage which added the method).
+        pool.try_refresh_matching()
 
     @pytest.mark.parametrize(
         "method,get_args",