diff --git a/templates/common/_base/files/etc-zincati-configd-90-disable-feature.yaml b/templates/common/_base/files/etc-zincati-configd-90-disable-feature.yaml
new file mode 100644
index 0000000000..742c048b4c
--- /dev/null
+++ b/templates/common/_base/files/etc-zincati-configd-90-disable-feature.yaml
@@ -0,0 +1,6 @@
+mode: 0755
+path: "/etc/zincati/config.d/90-disable-feature.toml"
+contents:
+  inline: |
+    [updates]
+    enabled = false
diff --git a/templates/common/_base/units/machine-config-daemon-firstboot.service.yaml b/templates/common/_base/units/machine-config-daemon-firstboot.service.yaml
index 4f4c28ce50..1914f32946 100644
--- a/templates/common/_base/units/machine-config-daemon-firstboot.service.yaml
+++ b/templates/common/_base/units/machine-config-daemon-firstboot.service.yaml
@@ -13,6 +13,7 @@ contents: |
   After=machine-config-daemon-pull.service
   Before=crio.service crio-wipe.service
   Before=kubelet.service
+  Before=zincati.service
 
   [Service]
   # Need oneshot to delay kubelet
diff --git a/templates/common/_base/units/machine-config-daemon-host.service.yaml b/templates/common/_base/units/machine-config-daemon-host.service.yaml
index 7723a90712..5e91597de2 100644
--- a/templates/common/_base/units/machine-config-daemon-host.service.yaml
+++ b/templates/common/_base/units/machine-config-daemon-host.service.yaml
@@ -11,6 +11,7 @@ contents: |
   ConditionPathExists=!/usr/lib/systemd/system/pivot.service
   After=ignition-firstboot-complete.service
   Before=kubelet.service
+  Before=zincati.service
 
   [Service]
   # Need oneshot to delay kubelet
diff --git a/templates/common/_base/units/machine-config-daemon-pull.service.yaml b/templates/common/_base/units/machine-config-daemon-pull.service.yaml
index 9c8bc8649b..7b2db2fde9 100644
--- a/templates/common/_base/units/machine-config-daemon-pull.service.yaml
+++ b/templates/common/_base/units/machine-config-daemon-pull.service.yaml
@@ -13,6 +13,7 @@ contents: |
   ConditionPathExists=!/usr/libexec/bin/machine-config-daemon
   After=ignition-firstboot-complete.service
   Before=machine-config-daemon-host.service
+  Before=zincati.service
 
   [Service]
   # Need oneshot to delay kubelet