diff --git a/controller/store/secret.go b/controller/store/secret.go
index 5e6f6550..1f5204e0 100644
--- a/controller/store/secret.go
+++ b/controller/store/secret.go
@@ -32,7 +32,7 @@ func (str *Store) CreateSecrets(secrets Secrets, trx *sqlx.Tx) error {
 
 func (str *Store) GetSecrets(shareId int, trx *sqlx.Tx) (Secrets, error) {
 	secrets := Secrets{}
-	rows, err := trx.Queryx("select key, value from secrets where share_id = $1 and not deleted", shareId)
+	rows, err := trx.Queryx("select key, value from secrets where share_id = $1", shareId)
 	if err != nil {
 		return Secrets{}, errors.Wrap(err, "error getting all from secrets")
 	}
@@ -45,3 +45,10 @@ func (str *Store) GetSecrets(shareId int, trx *sqlx.Tx) (Secrets, error) {
 	}
 	return secrets, nil
 }
+
+func (str *Store) DeleteSecrets(shareId int, trx *sqlx.Tx) error {
+	if _, err := trx.Exec("delete from secrets where share_id = $1", shareId); err != nil {
+		return errors.Wrapf(err, "error deleting secrets for share_id = '%v'", shareId)
+	}
+	return nil
+}
diff --git a/controller/store/sql/postgresql/034_v1_0_7_secrets.sql b/controller/store/sql/postgresql/034_v1_0_7_secrets.sql
index 815d8396..0186b5e3 100644
--- a/controller/store/sql/postgresql/034_v1_0_7_secrets.sql
+++ b/controller/store/sql/postgresql/034_v1_0_7_secrets.sql
@@ -8,8 +8,7 @@ create table secrets (
     value               text                    not null,
 
     created_at          timestamptz             not null default(current_timestamp),
-    updated_at          timestamptz             not null default(current_timestamp),
-    deleted             boolean                 not null default(false)
+    updated_at          timestamptz             not null default(current_timestamp)
 );
 
 create index secrets_share_id_idx on secrets(share_id);
diff --git a/controller/store/sql/sqlite3/034_v1_0_7_secrets.sql b/controller/store/sql/sqlite3/034_v1_0_7_secrets.sql
index 4e528272..b725a931 100644
--- a/controller/store/sql/sqlite3/034_v1_0_7_secrets.sql
+++ b/controller/store/sql/sqlite3/034_v1_0_7_secrets.sql
@@ -8,8 +8,7 @@ create table secrets (
     value               text                    not null,
 
     created_at          datetime                not null default(strftime('%Y-%m-%d %H:%M:%f', 'now')),
-    updated_at          datetime                not null default(strftime('%Y-%m-%d %H:%M:%f', 'now')),
-    deleted             boolean                 not null default(false)
+    updated_at          datetime                not null default(strftime('%Y-%m-%d %H:%M:%f', 'now'))
 );
 
 create index secrets_share_id_idx on secrets(share_id);
diff --git a/controller/unshare.go b/controller/unshare.go
index f120243b..a10dfd16 100644
--- a/controller/unshare.go
+++ b/controller/unshare.go
@@ -3,6 +3,8 @@ package controller
 import (
 	"context"
 	"fmt"
+	"time"
+
 	"github.com/go-openapi/runtime/middleware"
 	"github.com/openziti/edge-api/rest_management_api_client"
 	edge_service "github.com/openziti/edge-api/rest_management_api_client/service"
@@ -12,7 +14,6 @@ import (
 	"github.com/openziti/zrok/rest_server_zrok/operations/share"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
-	"time"
 )
 
 type unshareHandler struct{}
@@ -22,12 +23,12 @@ func newUnshareHandler() *unshareHandler {
 }
 
 func (h *unshareHandler) Handle(params share.UnshareParams, principal *rest_model_zrok.Principal) middleware.Responder {
-	tx, err := str.Begin()
+	trx, err := str.Begin()
 	if err != nil {
 		logrus.Errorf("error starting transaction for '%v': %v", principal.Email, err)
 		return share.NewUnshareInternalServerError()
 	}
-	defer func() { _ = tx.Rollback() }()
+	defer func() { _ = trx.Rollback() }()
 
 	edge, err := zrokEdgeSdk.Client(cfg.Ziti)
 	if err != nil {
@@ -41,7 +42,7 @@ func (h *unshareHandler) Handle(params share.UnshareParams, principal *rest_mode
 		return share.NewUnshareNotFound()
 	}
 	var senv *store.Environment
-	if envs, err := str.FindEnvironmentsForAccount(int(principal.ID), tx); err == nil {
+	if envs, err := str.FindEnvironmentsForAccount(int(principal.ID), trx); err == nil {
 		for _, env := range envs {
 			if env.ZId == params.Body.EnvZID {
 				senv = env
@@ -58,7 +59,7 @@ func (h *unshareHandler) Handle(params share.UnshareParams, principal *rest_mode
 	}
 
 	var sshr *store.Share
-	if shrs, err := str.FindSharesForEnvironment(senv.Id, tx); err == nil {
+	if shrs, err := str.FindSharesForEnvironment(senv.Id, trx); err == nil {
 		for _, shr := range shrs {
 			if shr.ZId == shrZId {
 				sshr = shr
@@ -79,15 +80,19 @@ func (h *unshareHandler) Handle(params share.UnshareParams, principal *rest_mode
 		h.deallocateResources(senv, shrToken, shrZId, edge)
 		logrus.Debugf("deallocated share '%v'", shrToken)
 
-		if err := str.DeleteAccessGrantsForShare(sshr.Id, tx); err != nil {
+		if err := str.DeleteSecrets(sshr.Id, trx); err != nil {
+			logrus.Errorf("error deleting secrets for share '%v': %v", shrToken, err)
+			return share.NewUnshareInternalServerError()
+		}
+		if err := str.DeleteAccessGrantsForShare(sshr.Id, trx); err != nil {
 			logrus.Errorf("error deleting access grants for share '%v': %v", shrToken, err)
 			return share.NewUnshareInternalServerError()
 		}
-		if err := str.DeleteShare(sshr.Id, tx); err != nil {
+		if err := str.DeleteShare(sshr.Id, trx); err != nil {
 			logrus.Errorf("error deleting share '%v': %v", shrToken, err)
 			return share.NewUnshareInternalServerError()
 		}
-		if err := tx.Commit(); err != nil {
+		if err := trx.Commit(); err != nil {
 			logrus.Errorf("error committing transaction for '%v': %v", shrZId, err)
 			return share.NewUnshareInternalServerError()
 		}