diff --git a/devstack/plugin.sh b/devstack/plugin.sh
index 8e25bd32..c6639981 100644
--- a/devstack/plugin.sh
+++ b/devstack/plugin.sh
@@ -20,6 +20,8 @@ function configure {
 
     iniset $TEMPEST_CONFIG whitebox-libvirt start_command "$WHITEBOX_LIBVIRT_START_COMMAND"
     iniset $TEMPEST_CONFIG whitebox-libvirt stop_command "$WHITEBOX_LIBVIRT_STOP_COMMAND"
+    iniset $TEMPEST_CONFIG whitebox-libvirt mask_command "$WHITEBOX_LIBVIRT_MASK_COMMAND"
+    iniset $TEMPEST_CONFIG whitebox-libvirt unmask_command "$WHITEBOX_LIBVIRT_UNMASK_COMMAND"
 
     iniset $TEMPEST_CONFIG whitebox-database user $DATABASE_USER
     iniset $TEMPEST_CONFIG whitebox-database password $DATABASE_PASSWORD
diff --git a/devstack/settings b/devstack/settings
index df877892..2402fb70 100644
--- a/devstack/settings
+++ b/devstack/settings
@@ -10,5 +10,7 @@ WHITEBOX_NOVA_COMPUTE_START_COMMAND=${WHITEBOX_NOVA_COMPUTE_START_COMMAND:-'syst
 
 WHITEBOX_LIBVIRT_START_COMMAND=${WHITEBOX_LIBVIRT_START_COMMAND:-'systemctl start libvirtd'}
 WHITEBOX_LIBVIRT_STOP_COMMAND=${WHITEBOX_LIBVIRT_STOP_COMMAND:-'systemctl stop libvirtd'}
+WHITEBOX_LIBVIRT_MASK_COMMAND=${WHITEBOX_LIBVIRT_MASK_COMMAND:-'systemctl mask libvirtd'}
+WHITEBOX_LIBVIRT_UNMASK_COMMAND=${WHITEBOX_LIBVIRT_UNMASK_COMMAND:-'systemctl unmask libvirtd'}
 
 WHITEBOX_CPU_TOPOLOGY=${WHITEBOX_CPU_TOPOLOGY:-''}
diff --git a/whitebox_tempest_plugin/config.py b/whitebox_tempest_plugin/config.py
index 6234c49c..9cead558 100644
--- a/whitebox_tempest_plugin/config.py
+++ b/whitebox_tempest_plugin/config.py
@@ -109,7 +109,20 @@ libvirt_opts = [
         help='Command to stop the libvirt service, without any '
              'privilege management (ie, no sudo).',
         deprecated_opts=[cfg.DeprecatedOpt('stop_command',
-                                           group='whitebox-nova-libvirt')])
+                                           group='whitebox-nova-libvirt')]),
+    cfg.StrOpt(
+        'mask_command',
+        help='In some situations (Ubuntu Focal, for example), libvirtd can '
+             'be activated by other systemd units even if it is stopped. '
+             'In such cases, it can be useful to mask a service (ie, disable '
+             'it completely) to prevent it from being started outside of our '
+             'control. This config options sets the command to mask libvirt. '
+             'If set, it will be executed after every stop command.'),
+    cfg.StrOpt(
+        'unmask_command',
+        help='Similar to the mask_command option, this config options sets '
+             'the command to unmask libvirt. If set, it will be run before '
+             'every start command.'),
 ]
 
 database_group = cfg.OptGroup(
diff --git a/whitebox_tempest_plugin/services/clients.py b/whitebox_tempest_plugin/services/clients.py
index 09620b07..02fb9747 100644
--- a/whitebox_tempest_plugin/services/clients.py
+++ b/whitebox_tempest_plugin/services/clients.py
@@ -86,9 +86,11 @@ class ServiceManager(SSHClient):
             raise exceptions.MissingServiceSectionException(service=service)
         self.service = service
         self.config_path = getattr(conf, 'config_path', None)
-        self.restart_command = getattr(conf, 'restart_command', None)
-        self.stop_command = getattr(conf, 'stop_command', None)
         self.start_command = getattr(conf, 'start_command', None)
+        self.stop_command = getattr(conf, 'stop_command', None)
+        self.restart_command = getattr(conf, 'restart_command', None)
+        self.mask_command = getattr(conf, 'mask_command', None)
+        self.unmask_command = getattr(conf, 'unmask_command', None)
 
     @contextlib.contextmanager
     def config_options(self, *opts):
@@ -162,10 +164,14 @@ class ServiceManager(SSHClient):
         return self.execute(command, container_name=None, sudo=True)
 
     def start(self):
+        if self.unmask_command:
+            self.execute(self.unmask_command, sudo=True)
         self.execute(self.start_command, sudo=True)
 
     def stop(self):
         self.execute(self.stop_command, sudo=True)
+        if self.unmask_command:
+            self.execute(self.mask_command, sudo=True)
 
     def restart(self):
         self.execute(self.restart_command, sudo=True)