diff --git a/barbican/server.sls b/barbican/server.sls
index ddeca48..15062fd 100644
--- a/barbican/server.sls
+++ b/barbican/server.sls
@@ -37,6 +37,7 @@
 barbican_sync_secret_stores:
   cmd.run:
   - name: barbican-manage db sync_secret_stores
+  - runas: barbican
   {%- if grains.get('noservices') or server.version in ['ocata', 'pike'] %}
   - onlyif: /bin/false
   {%- endif %}
@@ -99,6 +100,8 @@
     - group: barbican
     - watch_in:
       - service: barbican_server_services
+    - require_in:
+      - cmd: barbican_sync_secret_stores
 
 {%- endif %}