Does this work? Since the agent is disabled, you can't run puppet. Or is this meant for the installer which ignores the lock files?

Either way, I'd prefer ensure on a new line.