diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppRoleAuthentication.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppRoleAuthentication.java
index f703bc7d..44096287 100644
--- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppRoleAuthentication.java
+++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppRoleAuthentication.java
@@ -115,7 +115,7 @@ public class AppRoleAuthentication implements ClientAuthentication, Authenticati
 	private static Node<String> getRoleIdSteps(AppRoleAuthenticationOptions options, RoleId roleId) {
 
 		if (roleId instanceof Provided) {
-			return AuthenticationSteps.fromSupplier(((Provided) roleId)::getValue);
+			return AuthenticationSteps.fromValue(((Provided) roleId).getValue());
 		}
 
 		if (roleId instanceof Pull) {
@@ -138,7 +138,7 @@ public class AppRoleAuthentication implements ClientAuthentication, Authenticati
 	private static Node<String> getSecretIdSteps(AppRoleAuthenticationOptions options, SecretId secretId) {
 
 		if (secretId instanceof Provided) {
-			return AuthenticationSteps.fromSupplier(((Provided) secretId)::getValue);
+			return AuthenticationSteps.fromValue(((Provided) secretId).getValue());
 		}
 
 		if (secretId instanceof Pull) {
diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AzureMsiAuthentication.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AzureMsiAuthentication.java
index 528a1063..5720b97d 100644
--- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AzureMsiAuthentication.java
+++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AzureMsiAuthentication.java
@@ -131,7 +131,7 @@ public class AzureMsiAuthentication implements ClientAuthentication {
 					.map(AzureMsiAuthentication::toAzureVmEnvironment);
 		}
 		else {
-			environmentSteps = AuthenticationSteps.fromSupplier(() -> environment);
+			environmentSteps = AuthenticationSteps.fromValue(environment);
 		}
 
 		return environmentSteps.zipWith(msiToken)
diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/KubernetesAuthentication.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/KubernetesAuthentication.java
index 184623df..03ead623 100644
--- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/KubernetesAuthentication.java
+++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/KubernetesAuthentication.java
@@ -75,8 +75,8 @@ public class KubernetesAuthentication implements ClientAuthentication, Authentic
 
 		Assert.notNull(options, "KubernetesAuthenticationOptions must not be null");
 
-		String token = options.getJwtSupplier().get();
-		return AuthenticationSteps.fromSupplier(() -> getKubernetesLogin(options.getRole(), token))
+		return AuthenticationSteps.fromSupplier(options.getJwtSupplier())
+				.map(token -> getKubernetesLogin(options.getRole(), token))
 				.login(AuthenticationUtil.getLoginPath(options.getPath()));
 	}
 
diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/KubernetesAuthenticationOptions.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/KubernetesAuthenticationOptions.java
index 0e30205e..598cf4aa 100644
--- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/KubernetesAuthenticationOptions.java
+++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/KubernetesAuthenticationOptions.java
@@ -27,8 +27,8 @@ import org.springframework.util.Assert;
  * {@link KubernetesAuthentication} can be constructed using {@link #builder()}. Instances
  * of this class are immutable once constructed.
  * <p>
- * Default to obtain a cached token from
- * {@code /var/run/secrets/kubernetes.io/serviceaccount/token}.
+ * Defaults to obtain the token from
+ * {@code /var/run/secrets/kubernetes.io/serviceaccount/token} on each login.
  *
  * @author Michal Budzyn
  * @author Mark Paluch
@@ -155,7 +155,7 @@ public class KubernetesAuthenticationOptions {
 			Assert.notNull(this.role, "Role must not be null");
 
 			return new KubernetesAuthenticationOptions(this.path, this.role,
-					this.jwtSupplier == null ? new KubernetesServiceAccountTokenFile().cached() : this.jwtSupplier);
+					this.jwtSupplier == null ? new KubernetesServiceAccountTokenFile() : this.jwtSupplier);
 		}
 
 	}
diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/PcfAuthentication.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/PcfAuthentication.java
index 21462d50..b8a4548d 100644
--- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/PcfAuthentication.java
+++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/PcfAuthentication.java
@@ -90,10 +90,12 @@ public class PcfAuthentication implements ClientAuthentication, AuthenticationSt
 
 		Assert.notNull(options, "PcfAuthenticationOptions must not be null");
 
-		String instanceCert = options.getInstanceCertSupplier().get();
-		String instanceKey = options.getInstanceKeySupplier().get();
-		return AuthenticationSteps
-				.fromSupplier(() -> getPcfLogin(options.getRole(), options.getClock(), instanceCert, instanceKey)) //
+		AuthenticationSteps.Node<String> cert = AuthenticationSteps.fromSupplier(options.getInstanceCertSupplier());
+		AuthenticationSteps.Node<String> key = AuthenticationSteps.fromSupplier(options.getInstanceKeySupplier());
+
+		return cert
+				.zipWith(key).map(credentials -> getPcfLogin(options.getRole(), options.getClock(),
+						credentials.getLeft(), credentials.getRight()))
 				.login(AuthenticationUtil.getLoginPath(options.getPath()));
 	}
 
diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/PcfAuthenticationOptions.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/PcfAuthenticationOptions.java
index cc4822fc..425fefd6 100644
--- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/PcfAuthenticationOptions.java
+++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/PcfAuthenticationOptions.java
@@ -29,8 +29,8 @@ import org.springframework.util.StringUtils;
  * certificate {@link Supplier}s. {@link PcfAuthenticationOptions} can be constructed
  * using {@link #builder()}. Instances of this class are immutable once constructed.
  * <p>
- * Defaults to a cached instance certificate/key by resolving {@code CF_INSTANCE_CERT} and
- * {@code CF_INSTANCE_KEY} env variables.
+ * Defaults to platform-default instance certificate/key by resolving
+ * {@code CF_INSTANCE_CERT} and {@code CF_INSTANCE_KEY} env variables.
  *
  * @author Mark Paluch
  * @see CredentialSupplier
@@ -223,12 +223,12 @@ public class PcfAuthenticationOptions {
 			Supplier<String> instanceCertSupplier = this.instanceCertSupplier;
 
 			if (instanceCertSupplier == null) {
-				instanceCertSupplier = new ResourceCredentialSupplier(resolveEnvVariable("CF_INSTANCE_CERT")).cached();
+				instanceCertSupplier = new ResourceCredentialSupplier(resolveEnvVariable("CF_INSTANCE_CERT"));
 			}
 
 			Supplier<String> instanceKeySupplier = this.instanceKeySupplier;
 			if (instanceKeySupplier == null) {
-				instanceKeySupplier = new ResourceCredentialSupplier(resolveEnvVariable("CF_INSTANCE_KEY")).cached();
+				instanceKeySupplier = new ResourceCredentialSupplier(resolveEnvVariable("CF_INSTANCE_KEY"));
 			}
 
 			return new PcfAuthenticationOptions(this.path, this.role, this.clock, instanceCertSupplier,