diff --git a/roles/ipa/tasks/main.yml b/roles/ipa/tasks/main.yml
index 100d8a7f47..88b4b37e5f 100644
--- a/roles/ipa/tasks/main.yml
+++ b/roles/ipa/tasks/main.yml
@@ -37,10 +37,11 @@
   - ipa
   - config
 
-- name: disable kadmin
-  service: name=kadmin
-           enabled=no
+- name: mask kadmin
+  systemd: name=kadmin.service
            state=stopped
+           enabled=no
+           masked=yes
   tags:
   - ipa
   - config