diff --git a/src/Propellor/Property/Ssh.hs b/src/Propellor/Property/Ssh.hs
index 4f8ee32..b6ed476 100644
--- a/src/Propellor/Property/Ssh.hs
+++ b/src/Propellor/Property/Ssh.hs
@@ -98,8 +98,8 @@ hostKeys ctx l = propertyList desc $ catMaybes $
 	staletypes = let have = map fst l in filter (`notElem` have) alltypes
 	removestale b = map (File.notPresent . flip keyFile b) staletypes
 	cleanup
-		| null staletypes = Nothing
-		| otherwise = Just $ property ("stale host keys removed " ++ typelist staletypes) $
+		| null staletypes || null l = Nothing
+		| otherwise = Just $ property ("any other ssh host keys removed " ++ typelist staletypes) $
 			ensureProperty $
 				combineProperties desc (removestale True ++ removestale False)
 				`onChange` restarted