diff --git a/pkgs/clan-cli/clan_cli/facts/secret_modules/__init__.py b/pkgs/clan-cli/clan_cli/facts/secret_modules/__init__.py
index 34dc54b16..6850153bf 100644
--- a/pkgs/clan-cli/clan_cli/facts/secret_modules/__init__.py
+++ b/pkgs/clan-cli/clan_cli/facts/secret_modules/__init__.py
@@ -25,8 +25,8 @@ class SecretStoreBase(ABC):
     def exists(self, service: str, name: str) -> bool:
         pass
 
-    def update_check(self) -> bool:
-        return False
+    def needs_upload(self) -> bool:
+        return True
 
     @abstractmethod
     def upload(self, output_dir: Path) -> None:
diff --git a/pkgs/clan-cli/clan_cli/facts/secret_modules/password_store.py b/pkgs/clan-cli/clan_cli/facts/secret_modules/password_store.py
index f62f734c5..a416e3a54 100644
--- a/pkgs/clan-cli/clan_cli/facts/secret_modules/password_store.py
+++ b/pkgs/clan-cli/clan_cli/facts/secret_modules/password_store.py
@@ -92,7 +92,7 @@ class SecretStore(SecretStoreBase):
         return b"\n".join(hashes)
 
     @override
-    def update_check(self) -> bool:
+    def needs_upload(self) -> bool:
         local_hash = self.generate_hash()
         remote_hash = self.machine.target_host.run(
             # TODO get the path to the secrets from the machine
@@ -103,9 +103,9 @@ class SecretStore(SecretStoreBase):
 
         if not remote_hash:
             print("remote hash is empty")
-            return False
+            return True
 
-        return local_hash.decode() == remote_hash
+        return local_hash.decode() != remote_hash
 
     def upload(self, output_dir: Path) -> None:
         os.umask(0o077)
diff --git a/pkgs/clan-cli/clan_cli/facts/upload.py b/pkgs/clan-cli/clan_cli/facts/upload.py
index b1f87fdd1..e81b6c14c 100644
--- a/pkgs/clan-cli/clan_cli/facts/upload.py
+++ b/pkgs/clan-cli/clan_cli/facts/upload.py
@@ -16,8 +16,8 @@ def upload_secrets(machine: Machine) -> None:
     secret_facts_module = importlib.import_module(machine.secret_facts_module)
     secret_facts_store = secret_facts_module.SecretStore(machine=machine)
 
-    if secret_facts_store.update_check():
-        log.info("Secrets already up to date")
+    if not secret_facts_store.needs_upload():
+        log.info("Secrets already uploaded")
         return
     with TemporaryDirectory(prefix="facts-upload-") as tempdir:
         secret_facts_store.upload(Path(tempdir))
diff --git a/pkgs/clan-cli/clan_cli/vars/secret_modules/__init__.py b/pkgs/clan-cli/clan_cli/vars/secret_modules/__init__.py
index 77e1b8113..bec54847d 100644
--- a/pkgs/clan-cli/clan_cli/vars/secret_modules/__init__.py
+++ b/pkgs/clan-cli/clan_cli/vars/secret_modules/__init__.py
@@ -9,8 +9,8 @@ class SecretStoreBase(StoreBase):
     def is_secret_store(self) -> bool:
         return True
 
-    def update_check(self) -> bool:
-        return False
+    def needs_upload(self) -> bool:
+        return True
 
     @abstractmethod
     def upload(self, output_dir: Path) -> None:
diff --git a/pkgs/clan-cli/clan_cli/vars/secret_modules/password_store.py b/pkgs/clan-cli/clan_cli/vars/secret_modules/password_store.py
index e1c6630e0..4667be714 100644
--- a/pkgs/clan-cli/clan_cli/vars/secret_modules/password_store.py
+++ b/pkgs/clan-cli/clan_cli/vars/secret_modules/password_store.py
@@ -124,7 +124,7 @@ class SecretStore(SecretStoreBase):
         return b"\n".join(hashes)
 
     @override
-    def update_check(self) -> bool:
+    def needs_upload(self) -> bool:
         local_hash = self.generate_hash()
         remote_hash = self.machine.target_host.run(
             # TODO get the path to the secrets from the machine
@@ -135,9 +135,9 @@ class SecretStore(SecretStoreBase):
 
         if not remote_hash:
             print("remote hash is empty")
-            return False
+            return True
 
-        return local_hash.decode() == remote_hash
+        return local_hash.decode() != remote_hash
 
     def upload(self, output_dir: Path) -> None:
         for secret_var in self.get_all():
diff --git a/pkgs/clan-cli/clan_cli/vars/upload.py b/pkgs/clan-cli/clan_cli/vars/upload.py
index ef9a9cdc3..83f2542e6 100644
--- a/pkgs/clan-cli/clan_cli/vars/upload.py
+++ b/pkgs/clan-cli/clan_cli/vars/upload.py
@@ -16,8 +16,8 @@ def upload_secrets(machine: Machine) -> None:
     secret_store_module = importlib.import_module(machine.secret_facts_module)
     secret_store = secret_store_module.SecretStore(machine=machine)
 
-    if secret_store.update_check():
-        log.info("Secrets already up to date")
+    if not secret_store.needs_upload():
+        log.info("Secrets already uploaded")
         return
     with TemporaryDirectory(prefix="vars-upload-") as tempdir:
         secret_store.upload(Path(tempdir))