diff --git a/deployment/ironic/ironic-conductor-container-puppet.yaml b/deployment/ironic/ironic-conductor-container-puppet.yaml
index 26f185e781..b9b2f60f8d 100644
--- a/deployment/ironic/ironic-conductor-container-puppet.yaml
+++ b/deployment/ironic/ironic-conductor-container-puppet.yaml
@@ -301,6 +301,7 @@ outputs:
             ironic::conductor::automated_clean: {get_param: IronicAutomatedClean}
             ironic::conductor::enabled_hardware_types: {get_param: IronicEnabledHardwareTypes}
             ironic::conductor::force_power_state_during_sync: {get_param: IronicForcePowerStateDuringSync}
+            ironic::conductor::allow_provisioning_in_maintenance: false
             # We need an endpoint containing a real IP, not a VIP here
             ironic_conductor_http_host:
               str_replace:
diff --git a/releasenotes/notes/maint-cleaning-153aa746d92a5292.yaml b/releasenotes/notes/maint-cleaning-153aa746d92a5292.yaml
new file mode 100644
index 0000000000..26ef7acfb5
--- /dev/null
+++ b/releasenotes/notes/maint-cleaning-153aa746d92a5292.yaml
@@ -0,0 +1,11 @@
+---
+upgrade:
+  - |
+    The bare metal service (ironic) no longer allows nodes in maintenance
+    to enter deployment or cleaning. If a node enters maintenance during
+    deployment or cleaning, the process will be immediately aborted.
+fixes:
+  - |
+    Deployment or cleaning of bare metal nodes no longer gets stuck if a node
+    is in maintenance mode. The process is aborted instead and has to be
+    restarted after moving the node out of maintenance.