@@ -16,6 +16,9 @@ NOTE: There are a few optional configuration values that you can additionally
 set in your git configuration to influence the behavior of the bridge. Please
 see the notes at:
 https://github.com/git-bug/git-bug/blob/trunk/doc/jira_bridge.md
+
+The bridge retains the credential validated during setup. To rotate it, add
+the replacement token with --base-url and reconfigure with --credential.
 `
 
 const credTypeText = `
 
@@ -90,7 +90,14 @@ func TestTokenCredentials(t *testing.T) {
 	require.NoError(t, auth.Store(repo, replacement))
 	credentials, err = configuredCredentials(repo, legacyConf, auth.WithTarget(target))
 	require.NoError(t, err)
-	require.Equal(t, replacement.ID(), credentials[0].ID(), "newer tokens must rotate the configured token")
+	require.Equal(t, token.ID(), credentials[0].ID(), "adding a token must not silently replace the validated credential")
+	legacyConf[confKeyCredentialID] = replacement.ID().String()
+	credentials, err = configuredCredentials(repo, legacyConf, auth.WithTarget(target))
+	require.NoError(t, err)
+	require.Equal(t, replacement.ID(), credentials[0].ID(), "explicit reconfiguration selects the replacement token")
+	require.NoError(t, auth.Remove(repo, replacement.ID()))
+	_, err = configuredCredentials(repo, legacyConf, auth.WithTarget(target))
+	require.ErrorContains(t, err, "reconfigure the bridge")
 }
 
 func TestSessionCredentialsIgnoreNewerToken(t *testing.T) {
 
@@ -136,25 +136,12 @@ func configuredCredentials(repo repository.RepoKeyring, conf core.Configuration,
 		return nil, err
 	}
 	if id := conf[confKeyCredentialID]; id != "" {
-		configured, err := auth.LoadWithId(repo, entity.Id(id))
+		_, err := auth.LoadWithId(repo, entity.Id(id))
 		if err != nil {
-			if err == auth.ErrCredentialNotExist && len(credentials) > 0 {
-				return credentials, nil
-			}
-			return nil, err
-		}
-		// Retain the validated credential form, but permit rotation within
-		// that form. A newer account password must not replace an API token.
-		preferred := configured
-		login, _ := configured.GetMetadata(auth.MetaKeyLogin)
-		for _, candidate := range credentials {
-			candidateLogin, _ := candidate.GetMetadata(auth.MetaKeyLogin)
-			if candidateLogin == login && candidate.Kind() == configured.Kind() && candidate.CreateTime().After(preferred.CreateTime()) {
-				preferred = candidate
-			}
+			return nil, fmt.Errorf("configured Jira credential is missing; reconfigure the bridge with --credential: %w", err)
 		}
 		for i, credential := range credentials {
-			if credential.ID() == preferred.ID() {
+			if credential.ID().String() == id {
 				copy(credentials[1:i+1], credentials[:i])
 				credentials[0] = credential
 				return credentials, nil
Original file line number	Diff line number	Diff line change
`@@ -16,6 +16,9 @@ NOTE: There are a few optional configuration values that you can additionally`
`16`	`16`	`set in your git configuration to influence the behavior of the bridge. Please`
`17`	`17`	`see the notes at:`
`18`	`18`	`https://github.com/git-bug/git-bug/blob/trunk/doc/jira_bridge.md`
	`19`	`+`
	`20`	`+The bridge retains the credential validated during setup. To rotate it, add`
	`21`	`+the replacement token with --base-url and reconfigure with --credential.`
`19`	`22`	`
`20`	`23`
`21`	`24`	const credTypeText = `