fix(providers): keep refresh credential handles stable (#2780)