diff --git a/src/modules/services-systemd/main.py b/src/modules/services-systemd/main.py
index 31d205318..dce571384 100644
--- a/src/modules/services-systemd/main.py
+++ b/src/modules/services-systemd/main.py
@@ -76,5 +76,14 @@ def run():
     if r is not None:
         return r
 
+    r = systemctl(cfg["disable-targets"], "disable", ".target")
+    if r is not None:
+        return r
+
+    r = systemctl(cfg["mask"], "mask", "")
+    if r is not None:
+        return r
+
+
     # This could have just been return r
     return None
diff --git a/src/modules/services-systemd/services-systemd.conf b/src/modules/services-systemd/services-systemd.conf
index 64b95e125..082d63657 100644
--- a/src/modules/services-systemd/services-systemd.conf
+++ b/src/modules/services-systemd/services-systemd.conf
@@ -42,8 +42,22 @@
 # disable:
 #   - name: "pacman-init"
 #     mandatory: false
+#
+# # Disables <name>.target
+# disable-targets: []
+#
+# # Masks (stronger version of disable). This section
+# # is unusual because you **must** include the suffix
+# # (e.g. ".service") as part of the name, so, e.g. to mask
+# # NetworkManager (rather than just disable it) you must
+# # specify "NetworkManager.service" as name.
+# mask:
+#  - name: "NetworkManager.service"
+#  - mandatory: true
 
 # By default, no changes are made.
 services: []
 targets: []
 disable: []
+disable-targets: []
+mask: []