diff --git a/nfs-client/tasks/main.yml b/nfs-client/tasks/main.yml
index a737f14c70d59b3442b61f72fae0dfb3b3f7775e..de1368474f6e82866ab6a5560719f20866d9356f 100644
--- a/nfs-client/tasks/main.yml
+++ b/nfs-client/tasks/main.yml
@@ -76,10 +76,10 @@
   tags:
     - nfs-client
 
-- name: enable rpc-svcgssd iff we use kerberized NFS
+- name: Disable rpc-svcgssd
   systemd:
     name: rpc-svcgssd.service
-    masked: "{{ not nfs_enable_gss }}"
+    masked: true
   tags:
     - nfs-client
 
diff --git a/nfs-server/tasks/main.yml b/nfs-server/tasks/main.yml
index a3c4643ba2741e1a8be9670e22dd2d6076bfa76c..ce404ba896e22358e9b79df8ecf1cafd35f336c3 100644
--- a/nfs-server/tasks/main.yml
+++ b/nfs-server/tasks/main.yml
@@ -59,6 +59,13 @@
   tags:
     - nfs-server
 
+- name: Unmask rpc-svcgssd.service
+  systemd:
+    name: rpc-svcgssd.service
+    masked: false
+  tags:
+    - nfs-server
+
 - name: ensure nfs-server is enabled and running
   service:
     name: nfs-server