diff --git a/pkgs/clan-cli/clan_cli/secrets/secrets.py b/pkgs/clan-cli/clan_cli/secrets/secrets.py
index 22a21b7aa..f576833d2 100644
--- a/pkgs/clan-cli/clan_cli/secrets/secrets.py
+++ b/pkgs/clan-cli/clan_cli/secrets/secrets.py
@@ -99,7 +99,7 @@ def collect_keys_for_type(folder: Path) -> set[tuple[str, sops.KeyType]]:
         if not p.is_symlink():
             continue
         try:
-            target = p.resolve()
+            target = p.resolve(strict=True)
         except FileNotFoundError:
             log.warning(f"Ignoring broken symlink {p}")
             continue