diff --git a/pkgs/clan-cli/clan_cli/machines/machines.py b/pkgs/clan-cli/clan_cli/machines/machines.py
index 7fe9ee93f..f5749b038 100644
--- a/pkgs/clan-cli/clan_cli/machines/machines.py
+++ b/pkgs/clan-cli/clan_cli/machines/machines.py
@@ -16,8 +16,7 @@ from clan_cli.nix import nix_build, nix_config, nix_eval, nix_metadata, nix_test
 from clan_cli.ssh.host import Host
 from clan_cli.ssh.host_key import HostKeyCheck
 from clan_cli.ssh.parse import parse_deployment_address
-from clan_cli.vars.public_modules import FactStoreBase
-from clan_cli.vars.secret_modules import SecretStoreBase
+from clan_cli.vars._types import StoreBase
 
 log = logging.getLogger(__name__)
 
@@ -141,12 +140,12 @@ class Machine:
         return self.deployment["vars"]["publicModule"]
 
     @cached_property
-    def secret_vars_store(self) -> SecretStoreBase:
+    def secret_vars_store(self) -> StoreBase:
         module = importlib.import_module(self.secret_vars_module)
         return module.SecretStore(machine=self)
 
     @cached_property
-    def public_vars_store(self) -> FactStoreBase:
+    def public_vars_store(self) -> StoreBase:
         module = importlib.import_module(self.public_vars_module)
         return module.FactStore(machine=self)
 
diff --git a/pkgs/clan-cli/clan_cli/vars/check.py b/pkgs/clan-cli/clan_cli/vars/check.py
index a60aac489..5718ee01b 100644
--- a/pkgs/clan-cli/clan_cli/vars/check.py
+++ b/pkgs/clan-cli/clan_cli/vars/check.py
@@ -5,8 +5,7 @@ import logging
 from clan_cli.completions import add_dynamic_completer, complete_machines
 from clan_cli.errors import ClanError
 from clan_cli.machines.machines import Machine
-from clan_cli.vars.public_modules import FactStoreBase
-from clan_cli.vars.secret_modules import SecretStoreBase
+from clan_cli.vars._types import StoreBase
 
 log = logging.getLogger(__name__)
 
@@ -32,9 +31,9 @@ class VarStatus:
 
 def vars_status(machine: Machine, generator_name: None | str = None) -> VarStatus:
     secret_vars_module = importlib.import_module(machine.secret_vars_module)
-    secret_vars_store: SecretStoreBase = secret_vars_module.SecretStore(machine=machine)
+    secret_vars_store: StoreBase = secret_vars_module.SecretStore(machine=machine)
     public_vars_module = importlib.import_module(machine.public_vars_module)
-    public_vars_store: FactStoreBase = public_vars_module.FactStore(machine=machine)
+    public_vars_store: StoreBase = public_vars_module.FactStore(machine=machine)
 
     missing_secret_vars = []
     missing_public_vars = []
diff --git a/pkgs/clan-cli/clan_cli/vars/fix.py b/pkgs/clan-cli/clan_cli/vars/fix.py
index f194289f5..db84f8945 100644
--- a/pkgs/clan-cli/clan_cli/vars/fix.py
+++ b/pkgs/clan-cli/clan_cli/vars/fix.py
@@ -5,17 +5,16 @@ import logging
 from clan_cli.completions import add_dynamic_completer, complete_machines
 from clan_cli.errors import ClanError
 from clan_cli.machines.machines import Machine
-from clan_cli.vars.public_modules import FactStoreBase
-from clan_cli.vars.secret_modules import SecretStoreBase
+from clan_cli.vars._types import StoreBase
 
 log = logging.getLogger(__name__)
 
 
 def fix_vars(machine: Machine, generator_name: None | str = None) -> None:
     secret_vars_module = importlib.import_module(machine.secret_vars_module)
-    secret_vars_store: SecretStoreBase = secret_vars_module.SecretStore(machine=machine)
+    secret_vars_store: StoreBase = secret_vars_module.SecretStore(machine=machine)
     public_vars_module = importlib.import_module(machine.public_vars_module)
-    public_vars_store: FactStoreBase = public_vars_module.FactStore(machine=machine)
+    public_vars_store: StoreBase = public_vars_module.FactStore(machine=machine)
 
     generators = machine.vars_generators
     if generator_name:
diff --git a/pkgs/clan-cli/clan_cli/vars/generate.py b/pkgs/clan-cli/clan_cli/vars/generate.py
index 8887207ce..6fb0d366a 100644
--- a/pkgs/clan-cli/clan_cli/vars/generate.py
+++ b/pkgs/clan-cli/clan_cli/vars/generate.py
@@ -18,6 +18,7 @@ from clan_cli.errors import ClanError
 from clan_cli.git import commit_files
 from clan_cli.machines.inventory import get_all_machines, get_selected_machines
 from clan_cli.nix import nix_shell
+from clan_cli.vars._types import StoreBase
 
 from .check import check_vars
 from .graph import (
@@ -25,8 +26,6 @@ from .graph import (
     requested_closure,
 )
 from .prompt import Prompt, ask
-from .public_modules import FactStoreBase
-from .secret_modules import SecretStoreBase
 from .var import Var
 
 log = logging.getLogger(__name__)
@@ -99,8 +98,8 @@ def bubblewrap_cmd(generator: str, tmpdir: Path) -> list[str]:
 def decrypt_dependencies(
     machine: "Machine",
     generator: Generator,
-    secret_vars_store: SecretStoreBase,
-    public_vars_store: FactStoreBase,
+    secret_vars_store: StoreBase,
+    public_vars_store: StoreBase,
 ) -> dict[str, dict[str, bytes]]:
     decrypted_dependencies: dict[str, Any] = {}
     for generator_name in set(generator.dependencies):
@@ -143,8 +142,8 @@ def dependencies_as_dir(
 def execute_generator(
     machine: "Machine",
     generator: Generator,
-    secret_vars_store: SecretStoreBase,
-    public_vars_store: FactStoreBase,
+    secret_vars_store: StoreBase,
+    public_vars_store: StoreBase,
     prompt_values: dict[str, str],
 ) -> None:
     if not isinstance(machine.flake, Path):
diff --git a/pkgs/clan-cli/clan_cli/vars/list.py b/pkgs/clan-cli/clan_cli/vars/list.py
index b6c6d06e8..59f10af58 100644
--- a/pkgs/clan-cli/clan_cli/vars/list.py
+++ b/pkgs/clan-cli/clan_cli/vars/list.py
@@ -6,21 +6,20 @@ from clan_cli.api import API
 from clan_cli.completions import add_dynamic_completer, complete_machines
 from clan_cli.errors import ClanError
 from clan_cli.machines.machines import Machine
+from clan_cli.vars._types import StoreBase
 
 from ._types import GeneratorUpdate
 from .generate import Generator, Prompt, Var, execute_generator
-from .public_modules import FactStoreBase
-from .secret_modules import SecretStoreBase
 
 log = logging.getLogger(__name__)
 
 
-def public_store(machine: Machine) -> FactStoreBase:
+def public_store(machine: Machine) -> StoreBase:
     public_vars_module = importlib.import_module(machine.public_vars_module)
     return public_vars_module.FactStore(machine=machine)
 
 
-def secret_store(machine: Machine) -> SecretStoreBase:
+def secret_store(machine: Machine) -> StoreBase:
     secret_vars_module = importlib.import_module(machine.secret_vars_module)
     return secret_vars_module.SecretStore(machine=machine)
 
diff --git a/pkgs/clan-cli/clan_cli/vars/public_modules/__init__.py b/pkgs/clan-cli/clan_cli/vars/public_modules/__init__.py
index 5731afe50..e69de29bb 100644
--- a/pkgs/clan-cli/clan_cli/vars/public_modules/__init__.py
+++ b/pkgs/clan-cli/clan_cli/vars/public_modules/__init__.py
@@ -1,7 +0,0 @@
-from clan_cli.vars._types import StoreBase
-
-
-class FactStoreBase(StoreBase):
-    @property
-    def is_secret_store(self) -> bool:
-        return False
diff --git a/pkgs/clan-cli/clan_cli/vars/public_modules/in_repo.py b/pkgs/clan-cli/clan_cli/vars/public_modules/in_repo.py
index 0c8a63a96..05b594fc6 100644
--- a/pkgs/clan-cli/clan_cli/vars/public_modules/in_repo.py
+++ b/pkgs/clan-cli/clan_cli/vars/public_modules/in_repo.py
@@ -3,12 +3,15 @@ from pathlib import Path
 
 from clan_cli.errors import ClanError
 from clan_cli.machines.machines import Machine
+from clan_cli.vars._types import StoreBase
 from clan_cli.vars.generate import Generator, Var
 
-from . import FactStoreBase
 
+class FactStore(StoreBase):
+    @property
+    def is_secret_store(self) -> bool:
+        return False
 
-class FactStore(FactStoreBase):
     def __init__(self, machine: Machine) -> None:
         self.machine = machine
         self.works_remotely = False
diff --git a/pkgs/clan-cli/clan_cli/vars/public_modules/vm.py b/pkgs/clan-cli/clan_cli/vars/public_modules/vm.py
index def8173aa..4a6962e26 100644
--- a/pkgs/clan-cli/clan_cli/vars/public_modules/vm.py
+++ b/pkgs/clan-cli/clan_cli/vars/public_modules/vm.py
@@ -4,14 +4,17 @@ from pathlib import Path
 from clan_cli.dirs import vm_state_dir
 from clan_cli.errors import ClanError
 from clan_cli.machines.machines import Machine
+from clan_cli.vars._types import StoreBase
 from clan_cli.vars.generate import Generator, Var
 
-from . import FactStoreBase
-
 log = logging.getLogger(__name__)
 
 
-class FactStore(FactStoreBase):
+class FactStore(StoreBase):
+    @property
+    def is_secret_store(self) -> bool:
+        return False
+
     def __init__(self, machine: Machine) -> None:
         self.machine = machine
         self.works_remotely = False
diff --git a/pkgs/clan-cli/clan_cli/vars/secret_modules/__init__.py b/pkgs/clan-cli/clan_cli/vars/secret_modules/__init__.py
index 651d82a1b..e69de29bb 100644
--- a/pkgs/clan-cli/clan_cli/vars/secret_modules/__init__.py
+++ b/pkgs/clan-cli/clan_cli/vars/secret_modules/__init__.py
@@ -1,22 +0,0 @@
-from abc import abstractmethod
-from pathlib import Path
-from typing import TYPE_CHECKING
-
-from clan_cli.vars._types import StoreBase
-
-if TYPE_CHECKING:
-    pass
-
-
-class SecretStoreBase(StoreBase):
-    @property
-    def is_secret_store(self) -> bool:
-        return True
-
-    @abstractmethod
-    def populate_dir(self, output_dir: Path) -> None:
-        pass
-
-    @abstractmethod
-    def upload(self) -> None:
-        pass
diff --git a/pkgs/clan-cli/clan_cli/vars/secret_modules/password_store.py b/pkgs/clan-cli/clan_cli/vars/secret_modules/password_store.py
index 97e4e0f5e..d2c60aebc 100644
--- a/pkgs/clan-cli/clan_cli/vars/secret_modules/password_store.py
+++ b/pkgs/clan-cli/clan_cli/vars/secret_modules/password_store.py
@@ -10,14 +10,17 @@ from clan_cli.cmd import Log, RunOpts, run
 from clan_cli.machines.machines import Machine
 from clan_cli.nix import nix_shell
 from clan_cli.ssh.upload import upload
+from clan_cli.vars._types import StoreBase
 from clan_cli.vars.generate import Generator, Var
 
-from . import SecretStoreBase
-
 log = logging.getLogger(__name__)
 
 
-class SecretStore(SecretStoreBase):
+class SecretStore(StoreBase):
+    @property
+    def is_secret_store(self) -> bool:
+        return True
+
     def __init__(self, machine: Machine) -> None:
         self.machine = machine
         self.entry_prefix = "clan-vars"
diff --git a/pkgs/clan-cli/clan_cli/vars/secret_modules/sops.py b/pkgs/clan-cli/clan_cli/vars/secret_modules/sops.py
index 99c641305..2e571c8f7 100644
--- a/pkgs/clan-cli/clan_cli/vars/secret_modules/sops.py
+++ b/pkgs/clan-cli/clan_cli/vars/secret_modules/sops.py
@@ -19,11 +19,10 @@ from clan_cli.secrets.secrets import (
     has_secret,
 )
 from clan_cli.ssh.upload import upload
+from clan_cli.vars._types import StoreBase
 from clan_cli.vars.generate import Generator
 from clan_cli.vars.var import Var
 
-from . import SecretStoreBase
-
 
 @dataclass
 class SopsKey:
@@ -37,7 +36,11 @@ class MissingKeyError(ClanError):
         super().__init__(msg)
 
 
-class SecretStore(SecretStoreBase):
+class SecretStore(StoreBase):
+    @property
+    def is_secret_store(self) -> bool:
+        return True
+
     def __init__(self, machine: Machine) -> None:
         self.machine = machine
 
diff --git a/pkgs/clan-cli/clan_cli/vars/secret_modules/vm.py b/pkgs/clan-cli/clan_cli/vars/secret_modules/vm.py
index f6cb1b141..a484af564 100644
--- a/pkgs/clan-cli/clan_cli/vars/secret_modules/vm.py
+++ b/pkgs/clan-cli/clan_cli/vars/secret_modules/vm.py
@@ -3,12 +3,15 @@ from pathlib import Path
 
 from clan_cli.dirs import vm_state_dir
 from clan_cli.machines.machines import Machine
+from clan_cli.vars._types import StoreBase
 from clan_cli.vars.generate import Generator, Var
 
-from . import SecretStoreBase
 
+class SecretStore(StoreBase):
+    @property
+    def is_secret_store(self) -> bool:
+        return True
 
-class SecretStore(SecretStoreBase):
     def __init__(self, machine: Machine) -> None:
         self.machine = machine
         self.dir = vm_state_dir(machine.flake, machine.name) / "secrets"