diff --git a/cdist/conf/type/__systemd_unit/gencode-remote b/cdist/conf/type/__systemd_unit/gencode-remote
index 9c64b6c4..60486c52 100644
--- a/cdist/conf/type/__systemd_unit/gencode-remote
+++ b/cdist/conf/type/__systemd_unit/gencode-remote
@@ -33,16 +33,24 @@ if [ "${state}" = "absent" ]; then
 fi
 
 unit_status=$(cat "${__object}/explorer/unit-status")
+desired_enablement_state=$(cat "${__object}/parameter/enablement-state")
+
+if [ "${current_enablement_state}" = "masked" ] && \
+    [ "${desired_enablement_state}" != "masked" ]; then
+    echo "systemctl unmask ${name}"
+fi
 
 if [ -f "${__object}/parameter/restart" ]; then
-    if grep -q "^__file/etc/systemd/system/${name}" "${__messages_in}" || \
+    if [ "${desired_enablement_state}" = "masked" ]; then
+        if [ "${unit_status}" = "active" ]; then
+            echo "systemctl stop ${name}"
+        fi
+    elif grep -q "^__file/etc/systemd/system/${name}" "${__messages_in}" || \
         [ "${unit_status}" != "active" ]; then
         echo "systemctl restart ${name} || true"
     fi
 fi
 
-desired_enablement_state=$(cat "${__object}/parameter/enablement-state")
-
 if [ "${current_enablement_state}" = "${desired_enablement_state}" ]; then
     exit 0
 fi
@@ -58,6 +66,9 @@ case "${desired_enablement_state}" in
     disabled)
         echo "systemctl disable ${name}"
     ;;
+    masked)
+        echo "systemctl mask ${name}"
+    ;;
     *)
         echo "Unsupported unit status: ${desired_enablement_state}" >&2
         exit 1
diff --git a/cdist/conf/type/__systemd_unit/man.rst b/cdist/conf/type/__systemd_unit/man.rst
index 5d68b253..25a4e501 100644
--- a/cdist/conf/type/__systemd_unit/man.rst
+++ b/cdist/conf/type/__systemd_unit/man.rst
@@ -23,12 +23,14 @@ OPTIONAL PARAMETERS
 -------------------
 
 enablement-state
-    'enabled' or 'disabled', where:
+    'enabled', 'disabled' or 'masked', where:
 
     enabled
         enables the unit
     disabled
         disables the unit
+    masked
+        masks the unit
 
 source
     Path to the config file. If source is '-' (dash), take what was written to
@@ -38,15 +40,17 @@ state
     'present' or 'absent', defaults to 'present' where:
 
     present
-        the unit is installed
+        the unit (or its mask) is installed
     absent
-        the unit is stopped, disabled and uninstalled
+        The unit is stopped, disabled and uninstalled. If the unit was masked,
+        the mask is removed.
 
 BOOLEAN PARAMETERS
 ------------------
 
 restart
-    Restart the unit on unit file change or when the unit is inactive.
+    Start the unit if it was inactive. Restart the unit if the unit file
+    changed. Stop the unit if new ``enablement-state`` is ``masked``.
 
 MESSAGES
 --------
diff --git a/cdist/conf/type/__systemd_unit/manifest b/cdist/conf/type/__systemd_unit/manifest
index 7739c3d8..688a00b1 100644
--- a/cdist/conf/type/__systemd_unit/manifest
+++ b/cdist/conf/type/__systemd_unit/manifest
@@ -29,6 +29,7 @@ fi
 name="${__object_id}"
 source=$(cat "${__object}/parameter/source")
 state=$(cat "${__object}/parameter/state")
+enablement_state=$(cat "${__object}/parameter/enablement-state")
 
 # The unit must be disabled before removing its unit file. The unit file is
 # therefore removed by gencode-remote of this type, not here.
@@ -41,8 +42,17 @@ if [ "${source}" = "-" ]; then
     source="${__object}/stdin"
 fi
 
+unitfile_state="${state}"
+if [ "${enablement_state}" = "masked" ]; then
+    # Masking creates a symlink from /etc/systemd/system/<unit> to /dev/null.
+    # This process fails with "Failed to execute operation: Invalid argument"
+    # if file /etc/systemd/system/<unit> already exists. We must therefore
+    # remove it.
+    unitfile_state="absent"
+fi
+
 __config_file "/etc/systemd/system/${name}" \
     --mode 644 \
     --onchange "systemctl daemon-reload" \
     --source "${source}" \
-    --state "${state}"
+    --state "${unitfile_state}"