Because of this very scenario of there not being any single credential available that would be able to deploy on all selected workstations when they span multiple subnets/domains/etc. we added the option to use scanning credentials as a Run Mode for deployment packages.
The scanning credential option will use the cached credential first (credential used to last successfully scan), and if that isn't available it will follow the mapping order under Scanning\Scanning Credentials. This results in a dynamic, correct credential selection.
That said though, we've added "the option to enter a specific credential to be used for deployments when starting or scheduling them" to our customer wishlist.