diff --git a/cookbooks/fb_cron/README.md b/cookbooks/fb_cron/README.md
index e409cd497..ead5ca09c 100644
--- a/cookbooks/fb_cron/README.md
+++ b/cookbooks/fb_cron/README.md
@@ -21,6 +21,7 @@ Attributes
 * node['fb_cron']['anacrontab']['environment']['$SETTING']
 * node['fb_cron']['cron_allow']
 * node['fb_cron']['cron_deny']
+* node['fb_cron']['manage_packages']
 
 Usage
 -----
@@ -131,3 +132,8 @@ node.default['fb_cron']['cron_allow'] << 'user1'
 ```
 
 This can be used for compliance with security benchmarks.
+
+### Packages
+By default this cookbook keeps the cron package up-to-date, but if you
+want to manage them locally, simply set
+`node['fb_cron']['manage_packages']` to false.
diff --git a/cookbooks/fb_cron/attributes/default.rb b/cookbooks/fb_cron/attributes/default.rb
index 7ca566f52..586fbf311 100644
--- a/cookbooks/fb_cron/attributes/default.rb
+++ b/cookbooks/fb_cron/attributes/default.rb
@@ -34,4 +34,5 @@
   # This is a hidden attribute because people shouldn't change this unless
   # they know what they're doing.
   '_crontab_path' => '/etc/cron.d/fb_crontab',
+  'manage_packages' => true,
 }
diff --git a/cookbooks/fb_cron/recipes/packages.rb b/cookbooks/fb_cron/recipes/packages.rb
index 5b236e8f9..c2325e083 100644
--- a/cookbooks/fb_cron/recipes/packages.rb
+++ b/cookbooks/fb_cron/recipes/packages.rb
@@ -30,6 +30,7 @@
 
 if package_name
   package package_name do
+    only_if { node['fb_cron']['manage_packages'] }
     action :upgrade
   end
 end
diff --git a/cookbooks/fb_ethers/README.md b/cookbooks/fb_ethers/README.md
index 384d544d7..dac7bb2a4 100644
--- a/cookbooks/fb_ethers/README.md
+++ b/cookbooks/fb_ethers/README.md
@@ -9,6 +9,7 @@ Requirements
 Attributes
 ----------
 * node['fb_ethers']['entries']
+* node['fb_ethers']['manage_packages']
 
 Usage
 -----
@@ -22,3 +23,8 @@ node.default['fb_ethers']['entries'] = {
   '50:e5:49:2f:75:c6' => 'foo03',
 }
 ```
+
+### Packages
+By default this cookbook keeps the net-tools package up-to-date, but if you
+want to manage them locally, simply set
+`node['fb_ethers']['manage_packages']` to false.
diff --git a/cookbooks/fb_ethers/attributes/default.rb b/cookbooks/fb_ethers/attributes/default.rb
index 807812897..22d823bad 100644
--- a/cookbooks/fb_ethers/attributes/default.rb
+++ b/cookbooks/fb_ethers/attributes/default.rb
@@ -18,4 +18,5 @@
 
 default['fb_ethers'] = {
   'entries' => {},
+  'manage_packages' => true,
 }
diff --git a/cookbooks/fb_ethers/recipes/default.rb b/cookbooks/fb_ethers/recipes/default.rb
index 790035f41..aa41f9543 100644
--- a/cookbooks/fb_ethers/recipes/default.rb
+++ b/cookbooks/fb_ethers/recipes/default.rb
@@ -20,6 +20,7 @@
 
 package 'net-tools' do
   only_if { node.linux? }
+  only_if { node['fb_ethers']['manage_packages'] }
   action :upgrade
 end
 
diff --git a/cookbooks/fb_kpatch/README.md b/cookbooks/fb_kpatch/README.md
index 6484ade4d..f7eab8d4d 100644
--- a/cookbooks/fb_kpatch/README.md
+++ b/cookbooks/fb_kpatch/README.md
@@ -8,8 +8,14 @@ Requirements
 Attributes
 ----------
 * node['fb_kpatch']['enable']
+* node['fb_kpatch']['manage_packages']
 
 Usage
 -----
 Include `fb_kpatch::default` to install kpatch. The daemon is enabled and
 started by default; this can be controlled with `node['fb_kpatch']['enable']`.
+
+### Packages
+By default this cookbook keeps the kpatch-runtime package up-to-date, but if you
+want to manage them locally, simply set
+`node['fb_kpatch']['manage_packages']` to false.
diff --git a/cookbooks/fb_kpatch/attributes/default.rb b/cookbooks/fb_kpatch/attributes/default.rb
index 0758bf2a1..81bc08b87 100644
--- a/cookbooks/fb_kpatch/attributes/default.rb
+++ b/cookbooks/fb_kpatch/attributes/default.rb
@@ -18,4 +18,5 @@
 
 default['fb_kpatch'] = {
   'enable' => true,
+  'manage_packages' => true,
 }
diff --git a/cookbooks/fb_kpatch/recipes/default.rb b/cookbooks/fb_kpatch/recipes/default.rb
index 5d569b97f..05d087ddf 100644
--- a/cookbooks/fb_kpatch/recipes/default.rb
+++ b/cookbooks/fb_kpatch/recipes/default.rb
@@ -23,6 +23,7 @@
 end
 
 package 'kpatch-runtime' do
+  only_if { node['fb_kpatch']['manage_packages'] }
   action :upgrade
 end
 
diff --git a/cookbooks/fb_logrotate/README.md b/cookbooks/fb_logrotate/README.md
index 6d2d2ad1a..239f7ea32 100644
--- a/cookbooks/fb_logrotate/README.md
+++ b/cookbooks/fb_logrotate/README.md
@@ -19,6 +19,7 @@ Attributes
 * node['fb_logrotate']['debug_log']
 * node['fb_logrotate']['systemd_timer']
 * node['fb_logrotate']['timer_settings']
+* node['fb_logrotate']['manage_packages']
 
 Usage
 -----
@@ -238,3 +239,8 @@ Note that the use of the size property together with logrotate runs that are
 more frequent than daily will result in `duplicate log entry` errors in
 logrotate because the default dateformat is `-%Y%m%d`.  To handle this, specify
 a more granular dateformat, e.g. `-%Y%m%d%H`.
+
+### Packages
+By default this cookbook keeps the logrotate and pigz package up-to-date, but
+if you want to manage them locally, simply set
+`node['fb_logrotate']['manage_packages']` to false.
diff --git a/cookbooks/fb_logrotate/attributes/default.rb b/cookbooks/fb_logrotate/attributes/default.rb
index 9143fafeb..c0133ec3c 100644
--- a/cookbooks/fb_logrotate/attributes/default.rb
+++ b/cookbooks/fb_logrotate/attributes/default.rb
@@ -99,6 +99,7 @@
   'configs' => configs,
   'add_locking_to_logrotate' => false,
   'debug_log' => false,
+  'manage_packages' => true,
   'systemd_timer' => systemd_timer,
   'systemd_settings' => {
     'OnCalendar' => 'daily',
diff --git a/cookbooks/fb_logrotate/recipes/packages.rb b/cookbooks/fb_logrotate/recipes/packages.rb
index 621cd5497..00e414a49 100644
--- a/cookbooks/fb_logrotate/recipes/packages.rb
+++ b/cookbooks/fb_logrotate/recipes/packages.rb
@@ -20,5 +20,6 @@
 #
 
 package ['logrotate', 'pigz'] do
+  only_if { node['fb_logrotate']['manage_packages'] }
   action :upgrade
 end
diff --git a/cookbooks/fb_postfix/README.md b/cookbooks/fb_postfix/README.md
index 57cbe7682..5092bc634 100644
--- a/cookbooks/fb_postfix/README.md
+++ b/cookbooks/fb_postfix/README.md
@@ -26,6 +26,7 @@ Attributes
 * node['fb_postfix']['transport']
 * node['fb_postfix']['virtual']
 * node['fb_postfix']['custom_headers']
+* node['fb_postfix']['manage_packages']
 
 Usage
 -----
@@ -105,3 +106,8 @@ node.default['fb_postfix']['custom_headers']['some description'] = {
 
 *Note*: In `main.cf`, `header_checks` is by default pointed to
 `/etc/postfix/custom_headers.regexp`.
+
+### Packages
+By default this cookbook keeps the postfix package up-to-date, but if you
+want to manage them locally, simply set
+`node['fb_postfix']['manage_packages']` to false.
diff --git a/cookbooks/fb_postfix/attributes/default.rb b/cookbooks/fb_postfix/attributes/default.rb
index e87b22c1b..db016b0fe 100644
--- a/cookbooks/fb_postfix/attributes/default.rb
+++ b/cookbooks/fb_postfix/attributes/default.rb
@@ -115,6 +115,7 @@
     # Postfix will interpret this to be hostname
     'smtp_helo_name' => '$myhostname',
   },
+  'manage_packages' => true,
   # master.cf as per http://www.postfix.org/master.5.html
   # In master.cf, unique by service:type and not just service.
   'master.cf' => {
diff --git a/cookbooks/fb_postfix/recipes/packages.rb b/cookbooks/fb_postfix/recipes/packages.rb
index 8fcb56755..f50b2162c 100644
--- a/cookbooks/fb_postfix/recipes/packages.rb
+++ b/cookbooks/fb_postfix/recipes/packages.rb
@@ -19,5 +19,6 @@
 #
 
 package 'postfix' do
+  only_if { node['fb_postfix']['manage_packages'] }
   action :upgrade
 end
diff --git a/cookbooks/fb_sdparm/README.md b/cookbooks/fb_sdparm/README.md
index 90b826379..da5b78762 100644
--- a/cookbooks/fb_sdparm/README.md
+++ b/cookbooks/fb_sdparm/README.md
@@ -9,6 +9,7 @@ Attributes
 ----------
 * node['fb_sdparm']['enforce']
 * node['fb_sdparm']['settings']
+* node['fb_sdparm']['manage_packages']
 
 Usage
 -----
@@ -56,3 +57,8 @@ node.default['fb_sdparm']['enforce'] = true
   end
 end
 ```
+
+### Packages
+By default this cookbook keeps the sdparm package up-to-date, but if you
+want to manage them locally, simply set
+`node['fb_sdparm']['manage_packages']` to false.
diff --git a/cookbooks/fb_sdparm/attributes/default.rb b/cookbooks/fb_sdparm/attributes/default.rb
index 47bc6c5d4..878ea958e 100644
--- a/cookbooks/fb_sdparm/attributes/default.rb
+++ b/cookbooks/fb_sdparm/attributes/default.rb
@@ -18,6 +18,7 @@
 
 default['fb_sdparm'] = {
   'enforce' => false,
+  'manage_packages' => true,
   'settings' => {
     'rotational' => {},
     'non-rotational' => {},
diff --git a/cookbooks/fb_sdparm/recipes/packages.rb b/cookbooks/fb_sdparm/recipes/packages.rb
index 082db42f4..9fa476e14 100644
--- a/cookbooks/fb_sdparm/recipes/packages.rb
+++ b/cookbooks/fb_sdparm/recipes/packages.rb
@@ -19,5 +19,6 @@
 #
 
 package 'sdparm' do
+  only_if { node['fb_sdparm']['manage_packages'] }
   action :upgrade
 end
diff --git a/cookbooks/fb_sysstat/README.md b/cookbooks/fb_sysstat/README.md
index 28a832c5a..ee5f46e71 100644
--- a/cookbooks/fb_sysstat/README.md
+++ b/cookbooks/fb_sysstat/README.md
@@ -7,7 +7,13 @@ Requirements
 
 Attributes
 ----------
+* node['fb_sysstat']['manage_packages']
 
 Usage
 -----
 Include the cookbook in your recipe or runlist.
+
+### Packages
+By default this cookbook keeps the sysstat package up-to-date, but if you
+want to manage them locally, simply set
+`node['fb_sysstat']['manage_packages']` to false.
diff --git a/cookbooks/fb_sysstat/attributes/default.rb b/cookbooks/fb_sysstat/attributes/default.rb
new file mode 100644
index 000000000..0a7db8248
--- /dev/null
+++ b/cookbooks/fb_sysstat/attributes/default.rb
@@ -0,0 +1,20 @@
+# vim: syntax=ruby:expandtab:shiftwidth=2:softtabstop=2:tabstop=2
+#
+# Copyright (c) 2016-present, Facebook, Inc.
+# All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+default['fb_sysstat'] = {
+  'manage_packages' => true,
+}
diff --git a/cookbooks/fb_sysstat/recipes/packages.rb b/cookbooks/fb_sysstat/recipes/packages.rb
index d5e2d8d73..c23a56f2e 100644
--- a/cookbooks/fb_sysstat/recipes/packages.rb
+++ b/cookbooks/fb_sysstat/recipes/packages.rb
@@ -20,5 +20,6 @@
 #
 
 package 'sysstat' do
+  only_if { node['fb_sysstat']['manage_packages'] }
   action :upgrade
 end
diff --git a/cookbooks/fb_tcpdump/README.md b/cookbooks/fb_tcpdump/README.md
index 058a6872d..f0a4d84ff 100644
--- a/cookbooks/fb_tcpdump/README.md
+++ b/cookbooks/fb_tcpdump/README.md
@@ -10,8 +10,14 @@ Requirements
 
 Attributes
 ----------
+* node['fb_tcpdump']['manage_packages']
 
 Usage
 -----
 #### fb_tcpdump::default
 Just include the recipe in your runlist.
+
+### Packages
+By default this cookbook keeps the tcpdump package up-to-date, but if you
+want to manage them locally, simply set
+`node['fb_tcpdump']['manage_packages']` to false.
diff --git a/cookbooks/fb_tcpdump/attributes/default.rb b/cookbooks/fb_tcpdump/attributes/default.rb
new file mode 100644
index 000000000..7082d3a05
--- /dev/null
+++ b/cookbooks/fb_tcpdump/attributes/default.rb
@@ -0,0 +1,20 @@
+# vim: syntax=ruby:expandtab:shiftwidth=2:softtabstop=2:tabstop=2
+#
+# Copyright (c) 2016-present, Facebook, Inc.
+# All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+default['fb_tcpdump'] = {
+  'manage_packages' => true,
+}
diff --git a/cookbooks/fb_tcpdump/recipes/packages.rb b/cookbooks/fb_tcpdump/recipes/packages.rb
index 0ab135fc4..a85e35ca1 100644
--- a/cookbooks/fb_tcpdump/recipes/packages.rb
+++ b/cookbooks/fb_tcpdump/recipes/packages.rb
@@ -11,5 +11,6 @@
 end
 
 package 'tcpdump' do
+  only_if { node['fb_tcpdump']['manage_packages'] }
   action :upgrade
 end