diff --git a/pkgs/clan-cli/clan_cli/vars/generate.py b/pkgs/clan-cli/clan_cli/vars/generate.py
index e20de0c7a..a0a7c5965 100644
--- a/pkgs/clan-cli/clan_cli/vars/generate.py
+++ b/pkgs/clan-cli/clan_cli/vars/generate.py
@@ -297,6 +297,10 @@ def _check_can_migrate(
             if machine.secret_vars_store.exists(
                 generator_name, fname, vars_generator["share"]
             ):
+                if vars_generator["deploy"]:
+                    machine.secret_vars_store.ensure_machine_has_access(
+                        generator_name, fname, vars_generator["share"]
+                    )
                 return False
         else:
             if machine.public_vars_store.exists(