diff --git a/doc/source/bridge.rst b/doc/source/bridge.rst
index c9bbe3914c..39b6ad0fed 100644
--- a/doc/source/bridge.rst
+++ b/doc/source/bridge.rst
@@ -76,7 +76,9 @@ Each service that has been migrated fully to Ansible has its own playbook in
 :git_file:`playbooks` named ``service_{ service_name }.yaml``.
 
 Because the playbooks are normally run by zuul, to run them manually, first
-touch the file ``/home/zuul/DISABLE-ANSIBLE``. Then make sure no jobs are
+run the utility ``disable-ansible`` as root. That will touch the file
+``/home/zuul/DISABLE-ANSIBLE``. We use the utility to avoid mistyping the
+lockfile name. Then make sure no jobs are
 currently executing ansible. Ensure that ``/home/zuul/src/opendev.org/opendev/system-config``
 and ``/home/zuul/src/opendev.org/openstack/project-config`` are in the
 appropriate states, then run:
diff --git a/playbooks/roles/install-ansible/files/disable-ansible b/playbooks/roles/install-ansible/files/disable-ansible
new file mode 100644
index 0000000000..494c9df21f
--- /dev/null
+++ b/playbooks/roles/install-ansible/files/disable-ansible
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+# This is a simple script but ensures we don't mis-type the
+# file name.
+
+touch /home/zuul/DISABLE-ANSIBLE
diff --git a/playbooks/roles/install-ansible/tasks/main.yaml b/playbooks/roles/install-ansible/tasks/main.yaml
index 4b60745edd..c0774dc272 100644
--- a/playbooks/roles/install-ansible/tasks/main.yaml
+++ b/playbooks/roles/install-ansible/tasks/main.yaml
@@ -111,6 +111,14 @@
     src: roles/
     dest: /etc/ansible/roles
 
+- name: Copy disable-ansible utility script in place
+  copy:
+    src: disable-ansible
+    dest: /usr/local/bin/disable-ansible
+    mode: 0755
+    owner: root
+    group: root
+
 - name: Make sure k8s-on-openstack repo is up to date
   git:
     repo: https://github.com/infraly/k8s-on-openstack