diff --git a/nomad/state/state_store.go b/nomad/state/state_store.go
index 9056841d6..6397b1184 100644
--- a/nomad/state/state_store.go
+++ b/nomad/state/state_store.go
@@ -638,6 +638,22 @@ func (s *StateStore) NodesByIDPrefix(ws memdb.WatchSet, nodeID string) (memdb.Re
 	return iter, nil
 }
 
+// NodeBySecretID is used to lookup a node by SecretID
+func (s *StateStore) NodeBySecretID(ws memdb.WatchSet, secretID string) (*structs.Node, error) {
+	txn := s.db.Txn(false)
+
+	watchCh, existing, err := txn.FirstWatch("nodes", "secret_id", secretID)
+	if err != nil {
+		return nil, fmt.Errorf("node lookup by SecretID failed: %v", err)
+	}
+	ws.Add(watchCh)
+
+	if existing != nil {
+		return existing.(*structs.Node), nil
+	}
+	return nil, nil
+}
+
 // Nodes returns an iterator over all the nodes
 func (s *StateStore) Nodes(ws memdb.WatchSet) (memdb.ResultIterator, error) {
 	txn := s.db.Txn(false)
diff --git a/nomad/state/state_store_test.go b/nomad/state/state_store_test.go
index 0d62ff78b..c12c0631e 100644
--- a/nomad/state/state_store_test.go
+++ b/nomad/state/state_store_test.go
@@ -573,6 +573,15 @@ func TestStateStore_UpsertNode_Node(t *testing.T) {
 		t.Fatalf("err: %v", err)
 	}
 
+	out2, err := state.NodeBySecretID(ws, node.SecretID)
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+
+	if !reflect.DeepEqual(node, out2) {
+		t.Fatalf("bad: %#v %#v", node, out2)
+	}
+
 	if !reflect.DeepEqual(node, out) {
 		t.Fatalf("bad: %#v %#v", node, out)
 	}