diff --git a/sbin/tiny-cloud b/sbin/tiny-cloud
index 11f388c..db442b3 100755
--- a/sbin/tiny-cloud
+++ b/sbin/tiny-cloud
@@ -74,6 +74,11 @@ case "$phase" in
 	*) usage >&2; exit 1;;
 esac
 
+if [ -e "$ROOT"/etc/tiny-cloud.disabled ]; then
+	log -i -t "$phase" info "tiny-cloud disabled"
+	exit 0
+fi
+
 # is initial bootstrap already done?
 if is_bootstrap_complete; then
 	log -i -t "$phase" info "already bootstrapped"
diff --git a/tests/tiny-cloud.test b/tests/tiny-cloud.test
index b996f1c..b7e2288 100755
--- a/tests/tiny-cloud.test
+++ b/tests/tiny-cloud.test
@@ -10,6 +10,7 @@ PROVIDERS="alpine aws azure gcp nocloud oci"
 
 init_tests \
 	tiny_cloud_help \
+	tiny_cloud_disabled \
 	no_metadata_boot \
 	no_userdata_early \
 	no_userdata_main \
@@ -27,6 +28,16 @@ tiny_cloud_help_body() {
 	done
 }
 
+tiny_cloud_disabled_body() {
+	mkdir -p etc
+	touch etc/tiny-cloud.disabled
+	for provider in $PROVIDERS; do
+		CLOUD="$provider" atf_check -s exit:0 \
+			-e match:"tiny-cloud disabled" \
+			tiny-cloud early
+	done
+}
+
 no_metadata_boot_body() {
 	for provider in $PROVIDERS; do
 		CLOUD="$provider" atf_check \