diff --git a/templates/common/azure/units/machine-config-daemon-pull.service.yaml b/templates/common/azure/units/machine-config-daemon-pull.service.yaml
new file mode 100644
index 0000000000..a54a31e057
--- /dev/null
+++ b/templates/common/azure/units/machine-config-daemon-pull.service.yaml
@@ -0,0 +1,24 @@
+name: "machine-config-daemon-pull.service"
+enabled: true
+contents: |
+  [Unit]
+  Description=Machine Config Daemon Pull
+  # Make sure it runs only on OSTree booted system
+  ConditionPathExists=/run/ostree-booted
+  # This "stamp file" is unlinked when we complete
+  # machine-config-daemon-firstboot.service
+  ConditionPathExists=/etc/ignition-machine-config-encapsulated.json
+  # Run after crio-wipe so the pulled MCD image is protected against a corrupted storage from a forced shutdown
+  Wants=crio-wipe.service network-online.target
+  After=crio-wipe.service network-online.target
+
+  [Service]
+  Type=oneshot
+  RemainAfterExit=yes
+  ExecStart=/bin/sh -c "while ! /usr/bin/podman pull --authfile=/var/lib/kubelet/config.json '{{ .Images.machineConfigOperator }}'; do sleep 1; done"
+  {{if .Proxy -}}
+  EnvironmentFile=/etc/mco/proxy.env
+  {{end -}}
+
+  [Install]
+  RequiredBy=machine-config-daemon-firstboot.service