diff --git a/src/lighter/secretary.py b/src/lighter/secretary.py
index 7547096..6852a21 100644
--- a/src/lighter/secretary.py
+++ b/src/lighter/secretary.py
@@ -53,6 +53,10 @@ def apply(document, config):
     if not url:
         return config
 
+    # Avoid adding public keys if no secrets present
+    if not [value for value in config.get('env', {}).itervalues() if isEnvelope(value)]:
+        return config
+
     result = deepcopy(config)
     masterKey = decodePublicKey(util.rget(document, 'secretary', 'master', 'publickey'))
 
diff --git a/src/lighter/test/secretary_test.py b/src/lighter/test/secretary_test.py
index 4ebcaa6..16ced7e 100644
--- a/src/lighter/test/secretary_test.py
+++ b/src/lighter/test/secretary_test.py
@@ -25,3 +25,10 @@ def testRedeployWithoutChange(self):
 
         self.assertNotEqual(service1.config['env']['DEPLOY_PUBLIC_KEY'], service2.config['env']['DEPLOY_PUBLIC_KEY'])
         self.assertNotEqual(service1.config['env']['DEPLOY_PRIVATE_KEY'], service2.config['env']['DEPLOY_PRIVATE_KEY'])
+
+    def testServiceWithoutSecrets(self):
+        service = lighter.parse_service('src/resources/yaml/staging/myservice-nosecret.yml')
+        self.assertFalse('SECRETARY_URL' in service.config['env'])
+        self.assertFalse('MASTER_PRIVATE_KEY' in service.config['env'])
+        self.assertFalse('DEPLOY_PUBLIC_KEY' in service.config['env'])
+        self.assertFalse('DEPLOY_PRIVATE_KEY' in service.config['env'])
diff --git a/src/resources/yaml/staging/myservice-nosecret.yml b/src/resources/yaml/staging/myservice-nosecret.yml
new file mode 100644
index 0000000..1314a50
--- /dev/null
+++ b/src/resources/yaml/staging/myservice-nosecret.yml
@@ -0,0 +1,11 @@
+maven:
+  groupid: 'com.meltwater'
+  artifactid: 'myservice'
+  version: '1.0.0'
+override:
+  env:
+    DATABASE: 'database:3306'
+variables:
+  avar: '123'
+  bvar: '%{avar}'
+  cvar: '%{avar}'