diff --git a/core/imageroot/var/lib/nethserver/cluster/bin/apply-updates b/core/imageroot/var/lib/nethserver/cluster/bin/apply-updates
index 17c6678ea..b0a265eda 100755
--- a/core/imageroot/var/lib/nethserver/cluster/bin/apply-updates
+++ b/core/imageroot/var/lib/nethserver/cluster/bin/apply-updates
@@ -11,7 +11,18 @@ import os
 import sys
 
 rdb = agent.redis_connect()
-# Find cluster nodes from the index key
+
+# Inhibit automated updates if a NS7 node has joined the cluster. During
+# NS7 migration, an NS7 node has the "nomodules" flag, indicating no NS8
+# modules.
+for kflags in rdb.keys('node/*/flags'):
+    if bool(rdb.sismember(kflags, 'nomodules')):
+        node_id = kflags.removesuffix('/flags')
+        print(agent.SD_NOTICE + f"Skipping updates: NS7 {node_id} is part of the cluster.", file=sys.stderr)
+        sys.exit(0)
+
+# Find cluster nodes from the index key. Any NS8 node has at least a
+# Traefik module.
 nodes = list(int(node_id) for node_id in set(rdb.hvals("cluster/module_node")))
 terrors = agent.tasks.runp_brief(list({
         "agent_id": f'node/{node_id}',