diff --git a/system/systemd.go b/system/systemd.go
index 5a80068..f5ef23a 100644
--- a/system/systemd.go
+++ b/system/systemd.go
@@ -165,3 +165,11 @@ func MachineID(root string) string {
 
 	return id
 }
+
+func MaskUnit(unit string, root string) error {
+	masked := path.Join(root, "etc", "systemd", "system", unit)
+	if err := os.MkdirAll(path.Dir(masked), os.FileMode(0755)); err != nil {
+		return err
+	}
+	return os.Symlink("/dev/null", masked)
+}
diff --git a/system/systemd_test.go b/system/systemd_test.go
index 201f1a0..677afcb 100644
--- a/system/systemd_test.go
+++ b/system/systemd_test.go
@@ -123,3 +123,22 @@ func TestMachineID(t *testing.T) {
 		t.Fatalf("File has incorrect contents")
 	}
 }
+func TestMaskUnit(t *testing.T) {
+	dir, err := ioutil.TempDir(os.TempDir(), "coreos-cloudinit-")
+	if err != nil {
+		t.Fatalf("Unable to create tempdir: %v", err)
+	}
+	defer os.RemoveAll(dir)
+	if err := MaskUnit("foo.service", dir); err != nil {
+		t.Fatalf("Unable to mask unit: %v", err)
+	}
+
+	fullPath := path.Join(dir, "etc", "systemd", "system", "foo.service")
+	target, err := os.Readlink(fullPath)
+	if err != nil {
+		t.Fatalf("Unable to read link", err)
+	}
+	if target != "/dev/null" {
+		t.Fatalf("unit not masked, got unit target", target)
+	}
+}