diff --git a/cmd/server/operate.go b/cmd/server/operate.go
index 18d5da53..ddb74897 100644
--- a/cmd/server/operate.go
+++ b/cmd/server/operate.go
@@ -74,14 +74,6 @@ func operate(q queue.Service, e map[int]executor.Engine, t time.Duration) (err e
 					}
 				}()
 
-				logger.Info("pulling secrets")
-				// pull secrets for the build on the executor
-				err = executor.PullSecret(ctx)
-				if err != nil {
-					logger.Errorf("unable to pull secrets: %v", err)
-					return err
-				}
-
 				defer func() {
 					// destroying the build on the executor
 					logger.Info("destroying build")
diff --git a/executor/linux/build.go b/executor/linux/build.go
index cfb6eff5..2d3ffd9e 100644
--- a/executor/linux/build.go
+++ b/executor/linux/build.go
@@ -68,6 +68,15 @@ func (c *client) CreateBuild(ctx context.Context) error {
 
 	c.build = b
 
+	// TODO: Pull this out into a the plan function for steps.
+	c.logger.Info("pulling secrets")
+	// pull secrets for the build
+	err = c.PullSecret(ctx)
+	if err != nil {
+		e = err
+		return fmt.Errorf("unable to pull secrets: %v", err)
+	}
+
 	// TODO: make this better
 	init := new(pipeline.Container)
 	if len(p.Steps) > 0 {