diff --git a/stemcell_builder/stages/base_warden/apply.sh b/stemcell_builder/stages/base_warden/apply.sh
index a576d0b22f..c298a24d2c 100755
--- a/stemcell_builder/stages/base_warden/apply.sh
+++ b/stemcell_builder/stages/base_warden/apply.sh
@@ -73,5 +73,15 @@ for service in "${rosetta_services[@]}"; do
   cp "$assets_dir/rosetta-compat.conf" "$chroot/etc/systemd/system/${service}.service.d/rosetta-compat.conf"
 done
 
-# Mask systemd-binfmt.service which fails under Rosetta emulation
-run_in_chroot "$chroot" "systemctl mask systemd-binfmt.service"
+# Some services are not compatible with running in a container,
+# so we mask them to prevent systemd from trying to start them and fail.
+masked_services=(
+  systemd-binfmt
+)
+masked_service_units="${masked_services[*]/%/.service}"
+
+echo "base_warden: masking service units: ${masked_service_units}"
+run_in_chroot "$chroot" "systemctl mask ${masked_service_units}"
+
+echo "base_warden: service units kept (not masked):"
+run_in_chroot "$chroot" "systemctl list-unit-files --state=enabled,static --type=service --no-legend | awk '{print \$1}'"