diff --git a/stages/org.osbuild.systemd b/stages/org.osbuild.systemd
index 465f2f44..15770c96 100755
--- a/stages/org.osbuild.systemd
+++ b/stages/org.osbuild.systemd
@@ -31,6 +31,11 @@ SCHEMA = """
     "items": { "type": "string" },
     "description": "Array of systemd unit names to be enabled"
   },
+  "masked_services": {
+    "type": "array",
+    "items": { "type": "string" },
+    "description": "Array of systemd unit names to be masked"
+  },
   "default_target": {
     "type": "string",
     "description": "The default target to boot into"
@@ -41,6 +46,7 @@ SCHEMA = """
 def main(tree, options):
     enabled_services = options["enabled_services"]
     disabled_services = options.get("disabled_services", [])
+    masked_services = options.get("masked_services", [])
     default_target = options.get("default_target")
 
     for service in enabled_services:
@@ -49,6 +55,9 @@ def main(tree, options):
     for service in disabled_services:
         subprocess.run(["systemctl", "--root", tree, "disable", service], check=True)
 
+    for service in masked_services:
+        subprocess.run(["systemctl", "--root", tree, "mask", service], check=True)
+
     if default_target:
         subprocess.run(["systemctl", "--root", tree, "set-default", default_target], check=True)
 
diff --git a/test/data/stages/systemd/b.json b/test/data/stages/systemd/b.json
index 7c867d96..67b7f9b6 100644
--- a/test/data/stages/systemd/b.json
+++ b/test/data/stages/systemd/b.json
@@ -826,6 +826,9 @@
           "enabled_services": [
             "nftables"
           ],
+          "masked_services": [
+            "ldconfig"
+          ],
           "disabled_services": [
             "sshd"
           ]
diff --git a/test/data/stages/systemd/diff.json b/test/data/stages/systemd/diff.json
index 3d59c16f..7ceb776c 100644
--- a/test/data/stages/systemd/diff.json
+++ b/test/data/stages/systemd/diff.json
@@ -1,5 +1,6 @@
 {
   "added_files": [
+    "/etc/systemd/system/ldconfig.service",
     "/etc/systemd/system/multi-user.target.wants/nftables.service"
   ],
   "deleted_files": [