It turns out there's a simple fix for this: disable OS upgrades in the registry.

REG ADD HKLM\SOFTWARE\Policies\Microsoft\Windows\GWX /v DisableGWX /d 1
REG ADD HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /v DisableOSUpgrade /d 1
REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\OSUpgrade /v AllowOSUpgrade /d 0
REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\OSUpgrade /v ReservationsAllowed /d 0