diff --git a/playbooks/roles/create-venv/README.rst b/playbooks/roles/create-venv/README.rst
new file mode 100644
index 0000000000..4f3d95087b
--- /dev/null
+++ b/playbooks/roles/create-venv/README.rst
@@ -0,0 +1,19 @@
+Create a venv
+
+You would think this role is unnecessary and roles could just install
+a ``venv`` directly ... except sometimes pip/setuptools get out of
+date on a platform and can't understand how to install compatible
+things.  For example the pip shipped on Bionic will upgrade itself to
+a version that doesn't support Python 3.6 because it doesn't
+understand the metadata tags the new version marks itself with.  We've
+seen similar problems with wheels.  History has shown that whenever
+this problem appears solved, another issue will appear.  So for
+reasons like this, we have this as a synchronization point for setting
+up venvs.
+
+**Role Variables**
+
+.. zuul:rolevar:: create_venv_path
+   :default: unset
+
+   Required argument; the directory to make the ``venv``
diff --git a/playbooks/roles/create-venv/tasks/main.yaml b/playbooks/roles/create-venv/tasks/main.yaml
new file mode 100644
index 0000000000..cf0b7c559a
--- /dev/null
+++ b/playbooks/roles/create-venv/tasks/main.yaml
@@ -0,0 +1,25 @@
+- name: Check directory is specified
+  assert:
+    that: create_venv_path is defined
+
+# Bionic's default pip will try to pull in packages that
+# aren't compatible with 3.6.  Cap them
+- name: Setup bionic era venv
+  when: ansible_distribution_release == 'bionic'
+  pip:
+    name:
+      - pip<22
+      - setuptools<60
+    state: latest
+    virtualenv: '{{ create_venv_path }}'
+    virtualenv_command: '/usr/bin/python3 -m venv'
+
+- name: Setup later era venv
+  when: ansible_distribution_release != 'bionic'
+  pip:
+    name:
+      - pip
+      - setuptools
+    state: latest
+    virtualenv: '{{ create_venv_path }}'
+    virtualenv_command: '/usr/bin/python3 -m venv'
diff --git a/playbooks/roles/install-borg/tasks/main.yaml b/playbooks/roles/install-borg/tasks/main.yaml
index 7cf457c95f..e80edce9c7 100644
--- a/playbooks/roles/install-borg/tasks/main.yaml
+++ b/playbooks/roles/install-borg/tasks/main.yaml
@@ -17,6 +17,12 @@
       - fuse
       - pkg-config
 
+- name: Create venv
+  include_role:
+    name: create-venv
+  vars:
+    create_venv_path: '/opt/borg'
+
 - name: Install borg
   pip:
     # borg build deps are a little ... interesting, it needs cython
@@ -25,4 +31,3 @@
       - cython
       - 'borgbackup[fuse]=={{ borg_version }}'
     virtualenv: /opt/borg
-    virtualenv_command: /usr/bin/python3 -m venv