diff --git a/ansible/roles/ntp/tasks/prepare.yml b/ansible/roles/ntp/tasks/prepare.yml
index 5e365165a..cf4d82a74 100644
--- a/ansible/roles/ntp/tasks/prepare.yml
+++ b/ansible/roles/ntp/tasks/prepare.yml
@@ -4,7 +4,12 @@
 
 - name: Mask alternative NTP clients to prevent conflicts
   vars:
-    service_exists: "{{ item in ansible_facts.services }}"
+    # NOTE(mgoddard): The service_facts module can return services that are not
+    # present, possibly due to After/Before dependencies in other services.
+    # These show up with a status of 'not-found'.
+    service_exists: >-
+      {{ item in ansible_facts.services and
+         ansible_facts.services[item].status != 'not-found' }}
   systemd:
     name: "{{ item }}"
     enabled: "{{ 'false' if service_exists else omit }}"
diff --git a/releasenotes/notes/story-2009821-b309165e25e77aea.yaml b/releasenotes/notes/story-2009821-b309165e25e77aea.yaml
new file mode 100644
index 000000000..8d4d2ea43
--- /dev/null
+++ b/releasenotes/notes/story-2009821-b309165e25e77aea.yaml
@@ -0,0 +1,5 @@
+---
+fixes:
+  - |
+    Fixes an issue with masking NTP services which are not found. See `story
+    2009821 <https://storyboard.openstack.org/#!/story/2009821>`__ for details.