diff --git a/pkg/registry/apis/secret/contracts/keeper.go b/pkg/registry/apis/secret/contracts/keeper.go
index 48db9a13dc0..5558a4db3b5 100644
--- a/pkg/registry/apis/secret/contracts/keeper.go
+++ b/pkg/registry/apis/secret/contracts/keeper.go
@@ -10,7 +10,8 @@ import (
 )
 
 var (
-	ErrKeeperNotFound = errors.New("keeper not found")
+	ErrKeeperNotFound      = errors.New("keeper not found")
+	ErrKeeperAlreadyExists = errors.New("keeper already exists")
 )
 
 // KeeperMetadataStorage is the interface for wiring and dependency injection.
diff --git a/pkg/storage/secret/metadata/keeper_store.go b/pkg/storage/secret/metadata/keeper_store.go
index 7c9f12860ea..38c27cd1873 100644
--- a/pkg/storage/secret/metadata/keeper_store.go
+++ b/pkg/storage/secret/metadata/keeper_store.go
@@ -16,6 +16,7 @@ import (
 	"github.com/grafana/grafana/pkg/registry/apis/secret/contracts"
 	"github.com/grafana/grafana/pkg/registry/apis/secret/xkube"
 	"github.com/grafana/grafana/pkg/storage/secret/metadata/metrics"
+	"github.com/grafana/grafana/pkg/storage/unified/sql"
 	"github.com/grafana/grafana/pkg/storage/unified/sql/sqltemplate"
 )
 
@@ -91,13 +92,12 @@ func (s *keeperMetadataStorage) Create(ctx context.Context, keeper *secretv1beta
 			return err
 		}
 
-		// Validate before inserting that any `secureValues` referenced exist and do not reference other third-party keepers.
-		if err := s.validateSecureValueReferences(ctx, keeper); err != nil {
-			return err
-		}
-
 		result, err := s.db.ExecContext(ctx, query, req.GetArgs()...)
 		if err != nil {
+			if sql.IsRowAlreadyExistsError(err) {
+				return fmt.Errorf("namespace=%s name=%s: %w", keeper.Namespace, keeper.Name, contracts.ErrKeeperAlreadyExists)
+			}
+
 			return fmt.Errorf("inserting row: %w", err)
 		}
 
@@ -240,11 +240,6 @@ func (s *keeperMetadataStorage) Update(ctx context.Context, newKeeper *secretv1b
 			return err
 		}
 
-		// Validate before updating that any `secureValues` referenced exists and does not reference other third-party keepers.
-		if err := s.validateSecureValueReferences(ctx, newKeeper); err != nil {
-			return err
-		}
-
 		// Read old value first.
 		oldKeeperRow, err := s.read(ctx, newKeeper.Namespace, newKeeper.Name, contracts.ReadOpts{ForUpdate: true})
 		if err != nil {