diff --git a/user.yml b/user.yml
index de99f66..869e853 100644
--- a/user.yml
+++ b/user.yml
@@ -48,20 +48,12 @@
       - xdg-user-dirs-update.service
       - gnome-keyring-daemon.service
 
-- name: stop undesired service
-  systemd_service:
-    name: "{{ item }}"
-    scope: user
-    state: stopped
-  loop: "{{ undesired_user_services }}"
-
-# No way to use the `systemd` module here, as it needs a logind
-# session. So we have to handle the symlinks for masking ourselves.
-- name: disable and mask systemd user units
-  file:
-    state: link
-    dest: "/home/{{ user.name }}/.config/systemd/user/{{ item }}"
-    src: "/dev/null"
+# systemd needs a login session, machinectl handles that for us
+- name: stop and mask undesired services
+  command:
+    cmd: machinectl --uid {{ user.name }} shell -- .host /usr/bin/env systemctl --user mask --now "{{ item }}"
+  become: true
+  become_user: root
   loop: "{{ undesired_user_services }}"
 
 - name: create directory for getty autologin