diff --git a/desktop/files/apt-pin b/desktop/files/apt-pin
new file mode 100644
index 0000000000000000000000000000000000000000..0923a0107ee07dd7014e3f146e646f259f7a62e5
--- /dev/null
+++ b/desktop/files/apt-pin
@@ -0,0 +1,3 @@
+Package: plasma-nm network-manager cups-daemon plasma-discover
+Pin: origin *
+Pin-Priority: -1
diff --git a/desktop/tasks/main.yml b/desktop/tasks/main.yml
index 480abb96785722ec9ab9ddafe177fff564807822..d99195c20da04b6949c7cac0459c9f1cc97beeb4 100644
--- a/desktop/tasks/main.yml
+++ b/desktop/tasks/main.yml
@@ -1,5 +1,13 @@
 ---
 
+- name: Prevent apt from installing really unwanted packages
+  copy:
+    src: apt-pin
+    dest: /etc/apt/preferences.d/client
+    owner: root
+    group: root
+    mode: "0644"
+
 - import_tasks: kde.yml
 - meta: flush_handlers
 - import_tasks: software.yml