diff --git a/src/identity/mod.rs b/src/identity/mod.rs
index 5b359750..074b4e58 100644
--- a/src/identity/mod.rs
+++ b/src/identity/mod.rs
@@ -96,6 +96,17 @@ impl Identity {
         let basearch = coreos_stream_metadata::this_architecture().to_string();
         let current_os =
             rpm_ostree::parse_booted(&status).context("failed to introspect booted OS image")?;
+        let current_os = if let Some(o) = current_os {
+            o
+        } else {
+            log::info!("Disabling zincati automatic updates");
+            crate::utils::update_unit_status(
+                "Booted into container image; zincati updates disabled",
+            );
+            crate::utils::notify_ready();
+            crate::utils::notify_stopping();
+            std::process::exit(0);
+        };
         let node_uuid = {
             let app_id = id128::Id128::try_from_slice(APP_ID)
                 .map_err(|e| anyhow!("failed to parse application ID: {}", e))?;
diff --git a/src/rpm_ostree/cli_status.rs b/src/rpm_ostree/cli_status.rs
index fcc08abe..3464aacf 100644
--- a/src/rpm_ostree/cli_status.rs
+++ b/src/rpm_ostree/cli_status.rs
@@ -48,6 +48,7 @@ pub struct StatusJson {
 #[serde(rename_all = "kebab-case")]
 pub struct DeploymentJson {
     booted: bool,
+    container_image_reference: Option<String>,
     base_checksum: Option<String>,
     #[serde(rename = "base-commit-meta")]
     base_metadata: BaseCommitMetaJson,
@@ -62,7 +63,7 @@ pub struct DeploymentJson {
 #[derive(Clone, Debug, Deserialize)]
 struct BaseCommitMetaJson {
     #[serde(rename = "fedora-coreos.stream")]
-    stream: String,
+    stream: Option<String>,
 }
 
 impl DeploymentJson {
@@ -84,13 +85,21 @@ impl DeploymentJson {
 }
 
 /// Parse the booted deployment from status object.
-pub fn parse_booted(status: &StatusJson) -> Result<Release> {
-    let json = booted_json(status)?;
-    Ok(json.into_release())
+pub fn parse_booted(status: &StatusJson) -> Result<Option<Release>> {
+    let status = booted_json(status)?;
+    if let Some(img) = status.container_image_reference.as_ref() {
+        log::info!("Booted system is tracking {img}");
+        return Ok(None);
+    }
+    Ok(Some(status.into_release()))
 }
 
 fn fedora_coreos_stream_from_deployment(deploy: &DeploymentJson) -> Result<String> {
-    let stream = deploy.base_metadata.stream.as_str();
+    let stream = deploy
+        .base_metadata
+        .stream
+        .as_ref()
+        .ok_or_else(|| anyhow!("Missing `fedora-coreos.stream` in commit metadata"))?;
     ensure!(!stream.is_empty(), "empty stream value");
     Ok(stream.to_string())
 }