diff --git a/src/CronUpdater.php b/src/CronUpdater.php
index c78b9954ea26063cf0136c30704c6118344c166f..e6a9dc45735597d5a97b60e8113248aa09a3c37b 100644
--- a/src/CronUpdater.php
+++ b/src/CronUpdater.php
@@ -93,6 +93,19 @@ class CronUpdater extends Updater {
     }
   }
 
+  /**
+   * {@inheritdoc}
+   */
+  public function begin(array $project_versions, ?int $timeout = 300): string {
+    // Prevent mischievous callers from starting an update even if unattended
+    // updates are disabled. To start an update programmatically, use
+    // \Drupal\automatic_updates\Updater::begin().
+    if ($this->getMode() === static::DISABLED) {
+      throw new \LogicException('Unattended updates are disabled.');
+    }
+    return parent::begin($project_versions, $timeout);
+  }
+
   /**
    * Performs the update.
    *
diff --git a/tests/src/Functional/UpdaterFormTest.php b/tests/src/Functional/UpdaterFormTest.php
index 354fbc5b842874a1dc36f3fed5963d710ba5ff00..69ffa8a87d5ce019056081a19fb4b829f822deca 100644
--- a/tests/src/Functional/UpdaterFormTest.php
+++ b/tests/src/Functional/UpdaterFormTest.php
@@ -57,6 +57,7 @@ class UpdaterFormTest extends AutomaticUpdatesFunctionalTestBase {
       'access site in maintenance mode',
       'administer modules',
       'access site reports',
+      'view update notifications',
     ]);
     $this->drupalLogin($user);
     $this->checkForUpdates();
diff --git a/tests/src/Kernel/CronUpdaterTest.php b/tests/src/Kernel/CronUpdaterTest.php
index 9c2b57b167300ac379f7d96c36460ccf22227f13..2e70847acd404fcc6805c5d0a3d0557bc56cb08d 100644
--- a/tests/src/Kernel/CronUpdaterTest.php
+++ b/tests/src/Kernel/CronUpdaterTest.php
@@ -38,6 +38,7 @@ class CronUpdaterTest extends AutomaticUpdatesKernelTestBase {
   protected static $modules = [
     'automatic_updates',
     'automatic_updates_test',
+    'user',
   ];
 
   /**
@@ -328,4 +329,17 @@ class CronUpdaterTest extends AutomaticUpdatesKernelTestBase {
     }
   }
 
+  /**
+   * Tests that the cron updater throws an exception if started while disabled.
+   */
+  public function testExceptionWhenDisabled(): void {
+    $this->config('automatic_updates.settings')
+      ->set('cron', CronUpdater::DISABLED)
+      ->save();
+
+    $this->expectExceptionMessage('Unattended updates are disabled.');
+    $this->container->get('automatic_updates.cron_updater')
+      ->begin(['drupal' => '9.8.1']);
+  }
+
 }