Index: debian/neon-settings.neon-packagekit-offline-update-policy.service
===================================================================
--- /dev/null
+++ debian/neon-settings.neon-packagekit-offline-update-policy.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=Disable service starting during OS updates
+
+DefaultDependencies=no
+Requires=sysinit.target dbus.socket
+After=sysinit.target dbus.socket systemd-journald.socket
+Before=packagekit-offline-update.service shutdown.target system-update.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/sbin/org.kde.neon.packagekit.offline-policy.mgmt setup
+
+[Install]
+WantedBy=system-update.target
Index: debian/neon-settings.neon-packagekit-online-update-policy.service
===================================================================
--- /dev/null
+++ debian/neon-settings.neon-packagekit-online-update-policy.service
@@ -0,0 +1,22 @@
+# This runs on all boots to consistently clean up policy-rc.d
+# During our offline policy setup we'll create an empty file, we'll want to
+# drop this again to keep a clean system.
+
+# TODO: we could possibly move this into system-update and run it After the
+#   actual packagekit service. That is more involved because we also need to
+#   unmount though. It's also less reliable then actively forcing the cleanup
+#   whenever an unclean system is detected.
+# TODO: could disable this service by default and enable/disable in
+#   setup/teardown. That way we'd also avoid having to stat the file.
+
+[Unit]
+Description=Delete empty policy-rc.d [undo packagekit-offline-update-policy.service]
+ConditionPathExists=/usr/sbin/policy-rc.d
+ConditionFileNotEmpty=!/usr/sbin/policy-rc.d
+
+[Service]
+Type=oneshot
+ExecStart=/usr/sbin/org.kde.neon.packagekit.offline-policy.mgmt teardown
+
+[Install]
+WantedBy=default.target
Index: debian/rules
===================================================================
--- debian/rules
+++ debian/rules
@@ -12,13 +12,18 @@
 	dh_systemd_enable --name neon-update-calamares-groups
 	dh_systemd_enable --name setvtrgb
 	dh_systemd_enable --name neon-flathub
+	dh_systemd_enable --name neon-packagekit-offline-update-policy
+	dh_systemd_enable --name neon-packagekit-online-update-policy
 
 override_dh_systemd_start:
 	dh_systemd_start --no-start neon-update-calamares-groups.service
 	dh_systemd_start --no-start setvtrgb.service
 	dh_systemd_start --no-start neon-flathub.service
+	dh_systemd_start --no-start neon-packagekit-offline-update-policy
+	dh_systemd_start --no-start neon-packagekit-online-update-policy
 
 override_dh_installinit:
 	dh_installinit --noscripts --name neon-update-calamares-groups
 	dh_installinit --noscripts --name setvtrgb
-	dh_installinit --noscripts --name neon-flathub
+	dh_installinit --noscripts --name neon-packagekit-offline-update-policy
+	dh_installinit --noscripts --name neon-packagekit-online-update-policy
Index: usr/sbin/org.kde.neon.packagekit.offline-policy
===================================================================
--- /dev/null
+++ usr/sbin/org.kde.neon.packagekit.offline-policy
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+# Disable all actions during offline updates.
+# Specifically starting units must not happen
+# as they can fail to start in this minimal system
+# and in the worst case scenario will time out causing
+# substantial slowdown.
+
+exit 101
Index: usr/sbin/org.kde.neon.packagekit.offline-policy.mgmt
===================================================================
--- /dev/null
+++ usr/sbin/org.kde.neon.packagekit.offline-policy.mgmt
@@ -0,0 +1,32 @@
+#!/bin/sh
+
+set -ex
+
+POLICY_D=/usr/sbin/policy-rc.d
+OVERLAY=/usr/sbin/org.kde.neon.packagekit.offline-policy
+
+setup()
+{
+  touch $POLICY_D
+  mount --bind $OVERLAY $POLICY_D
+}
+
+teardown()
+{
+  # Our systemd service only runs iff the file is empty, so we can
+  # freely delete here.
+  rm -f $POLICY_D
+}
+
+case "$1" in
+  "setup")
+    setup
+    ;;
+  "teardown")
+    teardown
+    ;;
+  *)
+    echo "unknown action '$1'"
+    exit 1
+    ;;
+esac