diff --git a/roles/bootstrap-os/tasks/bootstrap-coreos.yml b/roles/bootstrap-os/tasks/bootstrap-coreos.yml
index 0cd318d6efd128fdcd7df80918a78574784547be..1bd861ca7537a2b20b2ee84dd20f6fa5ee0306bf 100644
--- a/roles/bootstrap-os/tasks/bootstrap-coreos.yml
+++ b/roles/bootstrap-os/tasks/bootstrap-coreos.yml
@@ -46,6 +46,9 @@
     PATH: "{{ ansible_env.PATH }}:{{ bin_dir }}"
 
 - name: Bootstrap | Disable auto-upgrade
-  shell: "systemctl stop locksmithd.service && systemctl mask --now locksmithd.service"
+  systemd:
+    name: locksmithd.service
+    masked: true
+    state: stopped
   when:
     - not coreos_auto_upgrade