diff --git a/src/reactive/barbican_handlers.py b/src/reactive/barbican_handlers.py
index 96afbb9..d88700a 100644
--- a/src/reactive/barbican_handlers.py
+++ b/src/reactive/barbican_handlers.py
@@ -59,6 +59,7 @@ def render_stuff(*args):
                                       'hsm.available',
                                       'secrets.available'))
         barbican_charm.configure_ssl()
+        barbican_charm.upgrade_if_available(args)
         barbican_charm.assess_status()
     reactive.set_flag('first-render')
 
diff --git a/unit_tests/test_barbican_handlers.py b/unit_tests/test_barbican_handlers.py
index 6057b10..e5a2c3d 100644
--- a/unit_tests/test_barbican_handlers.py
+++ b/unit_tests/test_barbican_handlers.py
@@ -72,6 +72,9 @@ class TestBarbicanHandlers(test_utils.PatchHelper):
         handlers.render_stuff('arg1', 'arg2')
         barbican_charm.render_with_interfaces.assert_called_once_with(
             ('arg1', 'arg2', 'hsm'))
+        barbican_charm.configure_ssl.assert_called_once_with()
+        barbican_charm.upgrade_if_available.assert_called_once_with(
+            ('arg1', 'arg2'))
         barbican_charm.assess_status.assert_called_once_with()
 
     def test_secrets_plugin_configure(self):