diff --git a/config/common.mk b/config/common.mk
index 06b0912d..a385b4f0 100644
--- a/config/common.mk
+++ b/config/common.mk
@@ -108,6 +108,10 @@ PRODUCT_COPY_FILES += \
     vendor/cm/prebuilt/common/bin/compcache:system/bin/compcache \
     vendor/cm/prebuilt/common/bin/handle_compcache:system/bin/handle_compcache
 
+# block stock OTAs
+PRODUCT_COPY_FILES += \
+    vendor/cm/prebuilt/common/bin/otablock:system/bin/otablock
+
 # Terminal Emulator
 PRODUCT_COPY_FILES +=  \
     vendor/cm/proprietary/Term.apk:system/app/Term.apk \
diff --git a/prebuilt/common/bin/otablock b/prebuilt/common/bin/otablock
new file mode 100644
index 00000000..b1a93f26
--- /dev/null
+++ b/prebuilt/common/bin/otablock
@@ -0,0 +1,9 @@
+#!/system/bin/sh
+
+
+## If these activities are installed, get rid of them. We don't want updates
+## coming in from outside CM
+
+exec 2>/dev/null
+pm disable com.google.android.gsf/com.google.android.gsf.update.SystemUpdateActivity
+pm disable com.google.android.gsf/com.google.android.gsf.update.SystemUpdateService
diff --git a/prebuilt/common/etc/init.local.rc b/prebuilt/common/etc/init.local.rc
index d62c1c24..5e341879 100644
--- a/prebuilt/common/etc/init.local.rc
+++ b/prebuilt/common/etc/init.local.rc
@@ -48,3 +48,12 @@ service sysinit /system/bin/sysinit
     user root
     oneshot
     disabled
+
+# Block stock OTA activities
+service otablock /system/bin/otablock
+    user root
+    oneshot
+    disabled
+
+on property:dev.bootcomplete=1
+    start otablock