diff --git a/internal/secrets/secrets.go b/internal/secrets/secrets.go
index 1656d89f..5d121115 100644
--- a/internal/secrets/secrets.go
+++ b/internal/secrets/secrets.go
@@ -17,6 +17,8 @@ var (
 	// interpRe is used for parsing secrets during interpolation. Secrets
 	// must not contain any curly braces.
 	interpRe = regexp.MustCompile(`\${(SECRET:[^}]+)}`)
+	// errNoSecret is returned when no secrets are found in the cache.
+	errNoSecret = fmt.Errorf("secrets: no secret found")
 	// KV store is used as a secrets cache
 	cache kv.Storer
 )
@@ -72,6 +74,10 @@ func Interpolate(ctx context.Context, s string) (string, error) {
 			return "", err
 		}
 
+		if secret == nil {
+			return "", errNoSecret
+		}
+
 		// Replaces each substring with a secret. If the secret is
 		// BAR and the string was "/path/to/secret/${SECRET:FOO}",
 		// then the interpolated  string output is "/path/to/secret/BAR".