diff --git a/playbooks/roles/install-launch-node/tasks/main.yaml b/playbooks/roles/install-launch-node/tasks/main.yaml
index 9b71f070df..2bc08db962 100644
--- a/playbooks/roles/install-launch-node/tasks/main.yaml
+++ b/playbooks/roles/install-launch-node/tasks/main.yaml
@@ -12,10 +12,20 @@
     group: root
     mode: '0600'
 
+# This is used to timestamp the launch-env-req.txt file.  This means
+# we will run --upgrade on the venv once a day, but otherwise leave it
+# alone.
+- name: Install node launcher stamp
+  template:
+    src: launch-env-req.txt.j2
+    dest: /usr/launcher-venv/launch-env-req.txt
+  register: _upgrade
+
 - name: Install node launcher
   pip:
     name: 'file:///home/zuul/src/opendev.org/opendev/system-config/launch'
     virtualenv: '/usr/launcher-venv'
+    state: '{{ "latest" if _upgrade.changed else "present" }}'
 
 # Admins use openstackclient on the bastion host to deal with cloud
 # issues.  The best version to use is the one from launch node, as
diff --git a/playbooks/roles/install-launch-node/templates/launch-env-req.txt.j2 b/playbooks/roles/install-launch-node/templates/launch-env-req.txt.j2
new file mode 100644
index 0000000000..f88788721c
--- /dev/null
+++ b/playbooks/roles/install-launch-node/templates/launch-env-req.txt.j2
@@ -0,0 +1 @@
+# Update timestamp: {{ now(fmt='%Y-%m-%d') }}