diff --git a/playbooks/base.yaml b/playbooks/base.yaml
index 183f3b36e9..1a5d126e8d 100644
--- a/playbooks/base.yaml
+++ b/playbooks/base.yaml
@@ -13,6 +13,7 @@
     - timezone
     - unbound
     - exim
+    - disable-puppet-agent
 
 # Do not run firewall rules on kubernetes hosts, they are managed by k8s-on-openstack.
 # TODO(mordred) snmpd should be able to be re-added to kubernetes hosts but we will
diff --git a/playbooks/roles/disable-puppet-agent/tasks/main.yaml b/playbooks/roles/disable-puppet-agent/tasks/main.yaml
index 2cbf884bb8..da59b717b2 100644
--- a/playbooks/roles/disable-puppet-agent/tasks/main.yaml
+++ b/playbooks/roles/disable-puppet-agent/tasks/main.yaml
@@ -10,3 +10,11 @@
     name: puppet
     enabled: no
     state: stopped
+  failed_when: false
+
+- name: Disable the mcollective service
+  service:
+    name: mcollective
+    enabled: no
+    state: stopped
+  failed_when: false