diff --git a/src/libostree/ostree-sysroot-deploy.c b/src/libostree/ostree-sysroot-deploy.c
index e7367bcce7..de3f879101 100644
--- a/src/libostree/ostree-sysroot-deploy.c
+++ b/src/libostree/ostree-sysroot-deploy.c
@@ -2885,6 +2885,17 @@ _ostree_sysroot_finalize_staged (OstreeSysroot *self,
       return TRUE;
     }
 
+  /* Check if finalization is gated. */
+  if (!glnx_fstatat_allow_noent (AT_FDCWD, _OSTREE_SYSROOT_RUNSTATE_STAGED_GATED,
+                                 NULL, 0, error))
+    return FALSE;
+  if (errno == ENOENT)
+    {
+      ot_journal_print (LOG_INFO, "Not finalizing; found "
+                                  _OSTREE_SYSROOT_RUNSTATE_STAGED_GATED);
+      return TRUE;
+    }
+
   /* Notice we send this *after* the trivial `return TRUE` above; this msg implies we've
    * committed to finalizing the deployment. */
     ot_journal_send ("MESSAGE_ID=" SD_ID128_FORMAT_STR,
diff --git a/src/libostree/ostree-sysroot-private.h b/src/libostree/ostree-sysroot-private.h
index 9da6d4c9e1..093b03a95d 100644
--- a/src/libostree/ostree-sysroot-private.h
+++ b/src/libostree/ostree-sysroot-private.h
@@ -76,6 +76,7 @@ struct OstreeSysroot {
 #define OSTREE_SYSROOT_LOCKFILE "ostree/lock"
 /* We keep some transient state in /run */
 #define _OSTREE_SYSROOT_RUNSTATE_STAGED "/run/ostree/staged-deployment"
+#define _OSTREE_SYSROOT_RUNSTATE_STAGED_GATED "/run/ostree/staged-deployment-gated"
 #define _OSTREE_SYSROOT_DEPLOYMENT_RUNSTATE_DIR "/run/ostree/deployment-state/"
 #define _OSTREE_SYSROOT_DEPLOYMENT_RUNSTATE_FLAG_DEVELOPMENT "unlocked-development"