diff --git a/pkgs/clan-cli/clan_cli/machines/update.py b/pkgs/clan-cli/clan_cli/machines/update.py
index e6f7dcf80..f2d2df54e 100644
--- a/pkgs/clan-cli/clan_cli/machines/update.py
+++ b/pkgs/clan-cli/clan_cli/machines/update.py
@@ -4,6 +4,8 @@ import os
 import subprocess
 
 from ..ssh import Host, HostGroup, HostKeyCheck
+from ..secrets.deploy import deploy_secrets
+from ..secrets.generate import generate_secrets
 
 
 def deploy_nixos(hosts: HostGroup) -> None:
@@ -32,6 +34,9 @@ def deploy_nixos(hosts: HostGroup) -> None:
 
         ssh_arg += " -i " + h.key if h.key else ""
 
+        generate_secrets(h.host)
+        deploy_secrets(h.host)
+
         flake_attr = h.meta.get("flake_attr", "")
         if flake_attr:
             flake_attr = "#" + flake_attr