diff --git a/kayobe/tests/unit/test_ansible.py b/kayobe/tests/unit/test_ansible.py
index 75166022f..79175cb4c 100644
--- a/kayobe/tests/unit/test_ansible.py
+++ b/kayobe/tests/unit/test_ansible.py
@@ -144,7 +144,7 @@ class TestCase(unittest.TestCase):
                         "KAYOBE_VAULT_PASSWORD": "test-pass"}
         expected_calls = [
             mock.call(["which", "kayobe-vault-password-helper"],
-                      check_output=True),
+                      check_output=True, universal_newlines=True),
             mock.call(expected_cmd, check_output=False, quiet=False,
                       env=expected_env)
         ]
@@ -191,7 +191,8 @@ class TestCase(unittest.TestCase):
         ansible.add_args(parser)
         vault.add_args(parser)
         mock_run.assert_called_once_with(
-            ["which", "kayobe-vault-password-helper"], check_output=True)
+            ["which", "kayobe-vault-password-helper"], check_output=True,
+            universal_newlines=True)
         mock_run.reset_mock()
         parsed_args = parser.parse_args([])
         ansible.run_playbooks(parsed_args, ["playbook1.yml"])
diff --git a/kayobe/tests/unit/test_kolla_ansible.py b/kayobe/tests/unit/test_kolla_ansible.py
index 3f114c3fc..ee27442dc 100644
--- a/kayobe/tests/unit/test_kolla_ansible.py
+++ b/kayobe/tests/unit/test_kolla_ansible.py
@@ -113,7 +113,7 @@ class TestCase(unittest.TestCase):
         expected_env = {"KAYOBE_VAULT_PASSWORD": "test-pass"}
         expected_calls = [
             mock.call(["which", "kayobe-vault-password-helper"],
-                      check_output=True),
+                      check_output=True, universal_newlines=True),
             mock.call(expected_cmd, shell=True, quiet=False, env=expected_env)
         ]
         self.assertEqual(expected_calls, mock_run.mock_calls)
@@ -155,7 +155,8 @@ class TestCase(unittest.TestCase):
         kolla_ansible.add_args(parser)
         vault.add_args(parser)
         mock_run.assert_called_once_with(
-            ["which", "kayobe-vault-password-helper"], check_output=True)
+            ["which", "kayobe-vault-password-helper"], check_output=True,
+            universal_newlines=True)
         mock_run.reset_mock()
         parsed_args = parser.parse_args([])
         kolla_ansible.run(parsed_args, "command", "overcloud")
diff --git a/kayobe/tests/unit/test_vault.py b/kayobe/tests/unit/test_vault.py
index a6d3fa778..dbb151afd 100644
--- a/kayobe/tests/unit/test_vault.py
+++ b/kayobe/tests/unit/test_vault.py
@@ -23,6 +23,15 @@ from kayobe import vault
 
 class TestCase(unittest.TestCase):
 
+    @mock.patch.object(vault.utils, "run_command", autospec=True)
+    def test__get_vault_password_helper(self, mock_run):
+        mock_run.return_value = "fake-password\n"
+        result = vault._get_vault_password_helper()
+        mock_run.assert_called_once_with(
+            ["which", "kayobe-vault-password-helper"], check_output=True,
+            universal_newlines=True)
+        self.assertEqual('fake-password', result)
+
     def test_validate_args_ok(self):
         parser = argparse.ArgumentParser()
         vault.add_args(parser)
diff --git a/kayobe/vault.py b/kayobe/vault.py
index db5adab4c..252ea97b9 100644
--- a/kayobe/vault.py
+++ b/kayobe/vault.py
@@ -30,7 +30,10 @@ def _get_vault_password_helper():
     """Return the path to the kayobe-vault-password-helper executable."""
     cmd = ["which", "kayobe-vault-password-helper"]
     try:
-        output = utils.run_command(cmd, check_output=True)
+        # NOTE(mgoddard): universal_newlines ensures stdout is opened in text
+        # mode, and we get a string rather than bytes.
+        output = utils.run_command(cmd, check_output=True,
+                                   universal_newlines=True)
     except subprocess.CalledProcessError:
         return None
     return output.strip()