diff --git a/cluster/juju/layers/kubernetes-master/reactive/kubernetes_master.py b/cluster/juju/layers/kubernetes-master/reactive/kubernetes_master.py
index 1547bc8bc93..4b0a94a9abe 100644
--- a/cluster/juju/layers/kubernetes-master/reactive/kubernetes_master.py
+++ b/cluster/juju/layers/kubernetes-master/reactive/kubernetes_master.py
@@ -102,12 +102,25 @@ def check_for_upgrade_needed():
     add_rbac_roles()
     set_state('reconfigure.authentication.setup')
     remove_state('authentication.setup')
+    if should_reinstall_snaps():
+        set_upgrade_needed()
+
+
+def should_reinstall_snaps():
+    ''' Return true if we should redeploy snaps. '''
+    # Snaps should be upgrades if:
+    # a) channel changed, or
+    # b) the Charms attached snaps (resources) changed
+    config = hookenv.config()
+    previous_channel = config.previous('channel')
+    new_channel = hookenv.config('channel')
+    if new_channel != previous_channel:
+        return True
 
     resources = ['kubectl', 'kube-apiserver', 'kube-controller-manager',
                  'kube-scheduler', 'cdk-addons']
     paths = [hookenv.resource_get(resource) for resource in resources]
-    if any_file_changed(paths):
-        set_upgrade_needed()
+    return any_file_changed(paths)
 
 
 def add_rbac_roles():
@@ -360,6 +373,7 @@ def set_app_version():
 
 @when('cdk-addons.configured', 'kube-api-endpoint.available',
       'kube-control.connected')
+@when_not('kubernetes-master.upgrade-needed')
 def idle_status(kube_api, kube_control):
     ''' Signal at the end of the run that we are running. '''
     if not all_kube_system_pods_running():