diff --git a/clouddriver-kubernetes-v2/src/main/java/com/netflix/spinnaker/clouddriver/kubernetes/v2/security/KubernetesV2Credentials.java b/clouddriver-kubernetes-v2/src/main/java/com/netflix/spinnaker/clouddriver/kubernetes/v2/security/KubernetesV2Credentials.java
index 9bfc7ce1676..65bff3c1654 100644
--- a/clouddriver-kubernetes-v2/src/main/java/com/netflix/spinnaker/clouddriver/kubernetes/v2/security/KubernetesV2Credentials.java
+++ b/clouddriver-kubernetes-v2/src/main/java/com/netflix/spinnaker/clouddriver/kubernetes/v2/security/KubernetesV2Credentials.java
@@ -90,9 +90,9 @@ public class KubernetesV2Credentials implements KubernetesCredentials {
 
   @Include private final String accountName;
 
-  @Include @Getter private final List<String> namespaces;
+  @Include @Getter private final ImmutableList<String> namespaces;
 
-  @Include @Getter private final List<String> omitNamespaces;
+  @Include @Getter private final ImmutableList<String> omitNamespaces;
 
   @Include private final ImmutableSet<KubernetesKind> kinds;
 
@@ -161,8 +161,8 @@ private KubernetesV2Credentials(
                 .collect(toImmutableList()));
 
     this.accountName = managedAccount.getName();
-    this.namespaces = managedAccount.getNamespaces();
-    this.omitNamespaces = managedAccount.getOmitNamespaces();
+    this.namespaces = ImmutableList.copyOf(managedAccount.getNamespaces());
+    this.omitNamespaces = ImmutableList.copyOf(managedAccount.getOmitNamespaces());
     this.kinds =
         managedAccount.getKinds().stream()
             .map(KubernetesKind::fromString)
@@ -211,7 +211,7 @@ private static class Memoizer<T> implements Supplier<T> {
     private Memoizer(Supplier<T> supplier, long expirySeconds, TimeUnit timeUnit) {
       this.cache =
           Caffeine.newBuilder()
-              .expireAfterWrite(expirySeconds, timeUnit)
+              .refreshAfterWrite(expirySeconds, timeUnit)
               .build(key -> supplier.get());
     }
 
diff --git a/clouddriver-kubernetes-v2/src/test/groovy/com/netflix/spinnaker/clouddriver/kubernetes/v2/validator/KubernetesValidationUtilSpec.groovy b/clouddriver-kubernetes-v2/src/test/groovy/com/netflix/spinnaker/clouddriver/kubernetes/v2/validator/KubernetesValidationUtilSpec.groovy
index 5be4a625f86..ad642e511f4 100644
--- a/clouddriver-kubernetes-v2/src/test/groovy/com/netflix/spinnaker/clouddriver/kubernetes/v2/validator/KubernetesValidationUtilSpec.groovy
+++ b/clouddriver-kubernetes-v2/src/test/groovy/com/netflix/spinnaker/clouddriver/kubernetes/v2/validator/KubernetesValidationUtilSpec.groovy
@@ -17,6 +17,7 @@
 
 package com.netflix.spinnaker.clouddriver.kubernetes.v2.validator
 
+import com.google.common.collect.ImmutableList
 import com.netflix.spinnaker.clouddriver.kubernetes.v2.description.manifest.KubernetesKind
 import com.netflix.spinnaker.clouddriver.kubernetes.v2.description.manifest.KubernetesManifest
 import com.netflix.spinnaker.clouddriver.kubernetes.v2.security.KubernetesV2Credentials
@@ -26,14 +27,16 @@ import org.springframework.validation.Errors
 import spock.lang.Specification
 import spock.lang.Unroll
 
+import javax.annotation.Nullable
+
 class KubernetesValidationUtilSpec extends Specification {
   @Unroll
   void "wiring of kind/namespace validation"() {
     given:
     Errors errors = Mock(Errors)
     String kubernetesAccount = "testAccount"
-    def namespaces = ["test-namespace"]
-    def omitNamespaces = ["omit-namespace"]
+    def namespaces = ImmutableList.of("test-namespace")
+    def omitNamespaces = ImmutableList.of("omit-namespace")
     def kind = KubernetesKind.DEPLOYMENT
     AccountCredentials accountCredentials = Mock(AccountCredentials)
     KubernetesV2Credentials credentials = Mock(KubernetesV2Credentials)
@@ -74,8 +77,8 @@ class KubernetesValidationUtilSpec extends Specification {
     def judgement = kubernetesValidationUtil.validateNamespace(testNamespace, credentials)
 
     then:
-    credentials.getOmitNamespaces() >> omitNamespaces
-    credentials.namespaces >> namespaces
+    credentials.getOmitNamespaces() >> toImmutableList(omitNamespaces)
+    credentials.namespaces >> toImmutableList(namespaces)
     judgement == allowedNamespace
 
     where:
@@ -93,4 +96,12 @@ class KubernetesValidationUtilSpec extends Specification {
     []                 | []                 | "unknown-namespace" || true
     []                 | ["omit-namespace"] | "unknown-namespace" || true
   }
+
+  @Nullable
+  private static <T> ImmutableList<T> toImmutableList(@Nullable Iterable<T> list) {
+    if (list == null) {
+      return null;
+    }
+    return ImmutableList.copyOf(list);
+  }
 }