diff --git a/jobs/golangapiserver/spec b/jobs/golangapiserver/spec
index 8e9c4ad8a2..b566a962ba 100644
--- a/jobs/golangapiserver/spec
+++ b/jobs/golangapiserver/spec
@@ -68,7 +68,7 @@ properties:
     default: ''
   autoscaler.apiserver.broker.default_credential_type:
     description: "The default credential type generated to authenticate with the custom metrics API. if no credential type is explicitly set.\nAllowed values:\n - binding-secret\n - x509\nIf credential-type \"binding-secret\" is set, then username and password are generated by the broker. \nIf credential-type \"x509\" is set, only instance identity credentials may be used.\n"
-    default: 'binding-secret'
+    default: 'x509'
   autoscaler.apiserver.broker.server.catalog:
     description: ""
   autoscaler.apiserver.broker.server.dashboard_redirect_uri:
diff --git a/spec/jobs/golangapiserver/apiserver_spec.rb b/spec/jobs/golangapiserver/apiserver_spec.rb
index adeed8de4a..9f34f4ac60 100644
--- a/spec/jobs/golangapiserver/apiserver_spec.rb
+++ b/spec/jobs/golangapiserver/apiserver_spec.rb
@@ -252,8 +252,8 @@
     end
 
     context "default_credential_type for custom metrics" do
-      it "has a value of binding-secret by default" do
-        expect(rendered_template).to include({"default_credential_type" => "binding-secret"})
+      it "has a value of x509 by default" do
+        expect(rendered_template).to include({"default_credential_type" => "x509"})
       end
     end
   end