diff --git a/profiles/cpu-partitioning/script.sh b/profiles/cpu-partitioning/script.sh
index 0e94d3a..efe9bcb 100755
--- a/profiles/cpu-partitioning/script.sh
+++ b/profiles/cpu-partitioning/script.sh
@@ -54,8 +54,8 @@ stop() {
     then
         sed -i '/^IRQBALANCE_BANNED_CPUS=/d' /etc/sysconfig/irqbalance
         teardown_kvm_mod_low_latency
+        enable_ksm
     fi
-    enable_ksm
     enable_balance_domains
     return "$?"
 }
diff --git a/profiles/functions b/profiles/functions
index 2df8168..919409c 100644
--- a/profiles/functions
+++ b/profiles/functions
@@ -531,35 +531,30 @@ teardown_kvm_mod_low_latency()
 
 KSM_SERVICES="ksm ksmtuned"
 KSM_RUN_PATH=/sys/kernel/mm/ksm/run
+KSM_MASK_FILE="${STORAGE_PERSISTENT}/ksm-masked"
 
 disable_ksm()
 {
-	for s in $KSM_SERVICES; do
-		if systemctl is-enabled -q $s; then
-			systemctl -q disable $s
+	if [ ! -f $KSM_MASK_FILE ]; then
+		# Always create $KSM_MASK_FILE, since we don't want to
+		# run any systemctl commands during boot
+		if ! touch $KSM_MASK_FILE; then
+			die "failed to create $KSM_MASK_FILE"
 		fi
-
-		if systemctl is-active -q $s; then
-			systemctl -q stop $s
-		fi
-	done
-
-	if [ -f $KSM_RUN_PATH ]; then
+		systemctl --now --quiet mask $KSM_SERVICES
 		# Unmerge all shared pages
-		echo 2 > $KSM_RUN_PATH
+		test -f $KSM_RUN_PATH && echo 2 > $KSM_RUN_PATH
 	fi
 }
 
+# Should only be called when full_rollback == true
 enable_ksm()
 {
-	for s in $KSM_SERVICES; do
-		systemctl -q preset $s
-
-		# Only start the service if it's enabled by defaut
-		if systemctl is-enabled -q $s; then
-			systemctl start $s
+	if [ -f $KSM_MASK_FILE ]; then
+		if systemctl --quiet unmask $KSM_SERVICES; then
+			rm -f $KSM_MASK_FILE
 		fi
-	done
+	fi
 }
 
 die() {
diff --git a/profiles/realtime-virtual-host/script.sh b/profiles/realtime-virtual-host/script.sh
index a9366cb..33a7996 100755
--- a/profiles/realtime-virtual-host/script.sh
+++ b/profiles/realtime-virtual-host/script.sh
@@ -93,8 +93,10 @@ start() {
 }
 
 stop() {
-    [ "$1" = "full_rollback" ] && teardown_kvm_mod_low_latency
-    enable_ksm
+    if [ "$1" = "full_rollback" ]; then
+        teardown_kvm_mod_low_latency
+        enable_ksm
+    fi
     systemctl stop rt-entsk
     return "$?"
 }