diff --git a/pkgs/sops-install-secrets/linux.go b/pkgs/sops-install-secrets/linux.go
index 6f50a7a..3e9e013 100644
--- a/pkgs/sops-install-secrets/linux.go
+++ b/pkgs/sops-install-secrets/linux.go
@@ -39,7 +39,7 @@ func SecureSymlinkChown(symlinkToCheck, expectedTarget string, owner, group int)
 	if err != nil {
 		return fmt.Errorf("cannot stat '%s': %w", symlinkToCheck, err)
 	}
-	if stat.Uid == uint32(owner) || stat.Gid == uint32(group) {
+	if stat.Uid == uint32(owner) && stat.Gid == uint32(group) {
 		return nil // already correct
 	}