--- a/browser/components/enterprisepolicies/tests/browser/disable_app_update/browser.ini
+++ b/browser/components/enterprisepolicies/tests/browser/disable_app_update/browser.ini
@@ -1,8 +1,10 @@
 [DEFAULT]
 prefs =
+  app.update.enabled=true
+  app.update.auto=true
   browser.policies.enabled=true
   browser.policies.alternatePath='<test-root>/browser/components/enterprisepolicies/tests/browser/disable_app_update/config_disable_app_update.json'
 support-files =
   config_disable_app_update.json
 
 [browser_policy_disable_app_update.js]

--- a/browser/components/enterprisepolicies/tests/browser/disable_app_update/browser_policy_disable_app_update.js
+++ b/browser/components/enterprisepolicies/tests/browser/disable_app_update/browser_policy_disable_app_update.js
@@ -7,8 +7,22 @@ var updateService = Cc["@mozilla.org/upd
 
 add_task(async function test_updates_post_policy() {
   is(Services.policies.isAllowed("appUpdate"), false,
      "appUpdate should be disabled by policy.");
 
   is(updateService.canCheckForUpdates, false,
      "Should not be able to check for updates with DisableAppUpdate enabled.");
 });
+
+add_task(async function test_update_preferences_ui() {
+  let tab = await BrowserTestUtils.openNewForegroundTab(gBrowser, "about:preferences");
+
+  await ContentTask.spawn(tab.linkedBrowser, null, async function() {
+    let updateRadioGroup = content.document.getElementById("updateRadioGroup");
+    is(updateRadioGroup.disabled, true,
+       "Update choices should be diabled when app update is locked by policy");
+    is(updateRadioGroup.value, "manual",
+       "Update choice should be set to \"manual\" when app update is disabled by policy");
+  });
+
+  await BrowserTestUtils.removeTab(tab);
+});

--- a/browser/components/preferences/in-content/main.js
+++ b/browser/components/preferences/in-content/main.js
@@ -1416,32 +1416,37 @@ var gMainPane = {
    *                   i     t/f    *t*     *true*
    *                   ii    t/f    f       false
    *                   ii    t/f    *t*     *true*
    */
   updateReadPrefs() {
     if (AppConstants.MOZ_UPDATER) {
       var enabledPref = Preferences.get("app.update.enabled");
       var autoPref = Preferences.get("app.update.auto");
+      let disabledByPolicy = Services.policies &&
+                             !Services.policies.isAllowed("appUpdate");
       var radiogroup = document.getElementById("updateRadioGroup");
 
-      if (!enabledPref.value) // Don't care for autoPref.value in this case.
+      if (!enabledPref.value || disabledByPolicy) // Don't care for autoPref.value in this case.
         radiogroup.value = "manual"; // 3. Never check for updates.
       else if (autoPref.value) // enabledPref.value && autoPref.value
         radiogroup.value = "auto"; // 1. Automatically install updates
       else // enabledPref.value && !autoPref.value
         radiogroup.value = "checkOnly"; // 2. Check, but let me choose
 
       var canCheck = Components.classes["@mozilla.org/updates/update-service;1"].
         getService(Components.interfaces.nsIApplicationUpdateService).
         canCheckForUpdates;
       // canCheck is false if the enabledPref is false and locked,
       // or the binary platform or OS version is not known.
       // A locked pref is sufficient to disable the radiogroup.
-      radiogroup.disabled = !canCheck || enabledPref.locked || autoPref.locked;
+      radiogroup.disabled = !canCheck ||
+                            enabledPref.locked ||
+                            autoPref.locked ||
+                            disabledByPolicy;
 
       if (AppConstants.MOZ_MAINTENANCE_SERVICE) {
         // Check to see if the maintenance service is installed.
         // If it is don't show the preference at all.
         var installed;
         try {
           var wrk = Components.classes["@mozilla.org/windows-registry-key;1"]
             .createInstance(Components.interfaces.nsIWindowsRegKey);
@@ -1458,17 +1463,19 @@ var gMainPane = {
       }
     }
   },
 
   /**
    * Sets the pref values based on the selected item of the radiogroup.
    */
   updateWritePrefs() {
-    if (AppConstants.MOZ_UPDATER) {
+    let disabledByPolicy = Services.policies &&
+                           !Services.policies.isAllowed("appUpdate");
+    if (AppConstants.MOZ_UPDATER && !disabledByPolicy) {
       var enabledPref = Preferences.get("app.update.enabled");
       var autoPref = Preferences.get("app.update.auto");
       var radiogroup = document.getElementById("updateRadioGroup");
       switch (radiogroup.value) {
         case "auto": // 1. Automatically install updates for Desktop only
           enabledPref.value = true;
           autoPref.value = true;
           break;