diff --git a/roles/bootstrap-os/tasks/bootstrap-coreos.yml b/roles/bootstrap-os/tasks/bootstrap-coreos.yml
index 0cd318d6e..1bd861ca7 100644
--- a/roles/bootstrap-os/tasks/bootstrap-coreos.yml
+++ b/roles/bootstrap-os/tasks/bootstrap-coreos.yml
@@ -46,6 +46,9 @@
     PATH: "{{ ansible_env.PATH }}:{{ bin_dir }}"
 
 - name: Bootstrap | Disable auto-upgrade
-  shell: "systemctl stop locksmithd.service && systemctl mask --now locksmithd.service"
+  systemd:
+    name: locksmithd.service
+    masked: true
+    state: stopped
   when:
     - not coreos_auto_upgrade