diff --git a/cmd/lk/agent.go b/cmd/lk/agent.go
index b82b9177..d55c90d5 100644
--- a/cmd/lk/agent.go
+++ b/cmd/lk/agent.go
@@ -1279,6 +1279,10 @@ func requireSecrets(_ context.Context, cmd *cli.Command, required, lazy bool) ([
 				continue
 			}
 
+			if v == "" {
+				return nil, fmt.Errorf("failed to parse secrets file: secret %s is empty, either remove it or provide a value", k)
+			}
+
 			secret := &lkproto.AgentSecret{
 				Name:  k,
 				Value: []byte(v),