diff --git a/builtin/files/userdata/cloud-config-controller b/builtin/files/userdata/cloud-config-controller
index 4b2adfab8..43b953d5f 100644
--- a/builtin/files/userdata/cloud-config-controller
+++ b/builtin/files/userdata/cloud-config-controller
@@ -40,13 +40,10 @@ coreos:
     reboot-strategy: "off"
   units:
 {{if .DisableContainerLinuxAutomaticUpdates}}
-    - name: disable-automatic-update.service
-      command: start
-      content: |
-        [Unit]
-        Description=Disable Container Linux automatic update. Work around to be removed on Ignition migration.
-        [Service]
-        ExecStart=/usr/bin/sh -c 'for u in update-engine locksmithd; do systemctl stop $${u}.service; systemctl mask $${u}.service; systemctl disable $${u}.service; done; systemctl reset-failed'
+    - name: update-engine.service
+      mask: true
+    - name: locksmithd.service
+      mask: true
 {{end}}
 
     - name: handle-disable-request.service
diff --git a/builtin/files/userdata/cloud-config-etcd b/builtin/files/userdata/cloud-config-etcd
index 69368d09a..d19a33718 100644
--- a/builtin/files/userdata/cloud-config-etcd
+++ b/builtin/files/userdata/cloud-config-etcd
@@ -42,13 +42,10 @@ coreos:
     reboot-strategy: "off"
   units:
 {{if .DisableContainerLinuxAutomaticUpdates}}
-    - name: disable-automatic-update.service
-      command: start
-      content: |
-        [Unit]
-        Description=Disable Container Linux automatic update. Work around to be removed on Ignition migration.
-        [Service]
-        ExecStart=/usr/bin/sh -c 'for u in update-engine locksmithd; do systemctl stop $${u}.service; systemctl mask $${u}.service; systemctl disable $${u}.service; done; systemctl reset-failed'
+    - name: update-engine.service
+      mask: true
+    - name: locksmithd.service
+      mask: true
 {{end}}
 {{- range $u := .Etcd.CustomSystemdUnits}}
     - name: {{$u.Name}}
diff --git a/builtin/files/userdata/cloud-config-worker b/builtin/files/userdata/cloud-config-worker
index 7822e6d59..22fdce314 100644
--- a/builtin/files/userdata/cloud-config-worker
+++ b/builtin/files/userdata/cloud-config-worker
@@ -42,13 +42,10 @@ coreos:
     reboot-strategy: "off"
   units:
 {{if .DisableContainerLinuxAutomaticUpdates}}
-    - name: disable-automatic-update.service
-      command: start
-      content: |
-        [Unit]
-        Description=Disable Container Linux automatic update. Work around to be removed on Ignition migration.
-        [Service]
-        ExecStart=/usr/bin/sh -c 'for u in update-engine locksmithd; do systemctl stop $${u}.service; systemctl mask $${u}.service; systemctl disable $${u}.service; done; systemctl reset-failed'
+    - name: update-engine.service
+      mask: true
+    - name: locksmithd.service
+      mask: true
 {{end}}
 {{- range $u := .CustomSystemdUnits}}
     - name: {{$u.Name}}
@@ -343,7 +340,7 @@ coreos:
         -v /etc/kubernetes:/etc/kubernetes:rw \
         -v /var/lib/kubelet:/var/lib/kubelet:rshared \
         -v /var/lib/docker:/var/lib/docker:rshared \
-        {{ if eq .ContainerRuntime "rkt" -}}
+        {{- if eq .ContainerRuntime "rkt" }}
         -v /opt/bin/host-rkt:/opt/bin/host-rkt:rw \
         -v /usr/bin/rkt:/usr/bin/rkt:ro \
         -v /var/lib/rkt:/usr/lib/rkt:rw \