diff --git a/truss/cli/cli.py b/truss/cli/cli.py
index 87900222a..929159dc4 100644
--- a/truss/cli/cli.py
+++ b/truss/cli/cli.py
@@ -447,6 +447,14 @@ def push(
 
         click.echo(draft_model_text)
 
+    # Log a warning if using secrets without --trusted.
+    # TODO(helen): this could be moved to a separate function that includes more config checks.
+    if tr.spec.config.secrets and not trusted:
+        not_trusted_text = """Warning: your Truss has secrets but was not pushed with --trusted.
+Please push with --trusted to grant access to secrets.
+"""
+        console.print(not_trusted_text, style="red")
+
     logs_url = remote_provider.get_remote_logs_url(service)  # type: ignore[attr-defined]
     rich.print(f"🪵  View logs for your deployment at {logs_url}")