diff --git a/ansible/roles/kolla-ansible/tasks/install.yml b/ansible/roles/kolla-ansible/tasks/install.yml
index e227612ae..a349274f1 100644
--- a/ansible/roles/kolla-ansible/tasks/install.yml
+++ b/ansible/roles/kolla-ansible/tasks/install.yml
@@ -7,6 +7,8 @@
     name: epel-release
     state: present
   become: True
+  vars:
+    ansible_python_interpreter: /usr/bin/python3
   when:
     - ansible_facts.os_family == 'RedHat'
     - kolla_ansible_install_epel | bool
@@ -18,6 +20,8 @@
     state: present
     cache_valid_time: "{{ apt_cache_valid_time if ansible_facts.os_family == 'Debian' else omit }}"
     update_cache: "{{ True if ansible_facts.os_family == 'Debian' else omit }}"
+  vars:
+    ansible_python_interpreter: /usr/bin/python3
   become: True
 
 - name: Ensure source code checkout parent directory exists
diff --git a/ansible/roles/selinux/tasks/main.yml b/ansible/roles/selinux/tasks/main.yml
index 54f699303..2e375d5a3 100644
--- a/ansible/roles/selinux/tasks/main.yml
+++ b/ansible/roles/selinux/tasks/main.yml
@@ -17,6 +17,8 @@
     policy: "{{ selinux_policy }}"
     state: "{{ selinux_state }}"
   register: selinux_result
+  vars:
+    ansible_python_interpreter: /usr/bin/python3
   become: True
   when: stat_result.stat.exists
 
diff --git a/dev/functions b/dev/functions
index 8455ba2ad..5afaffc87 100644
--- a/dev/functions
+++ b/dev/functions
@@ -141,10 +141,18 @@ function is_yum {
     fi
 }
 
+function get_python {
+  if is_dnf; then
+      echo python3.12
+  else
+      echo python3
+  fi
+}
+
 function install_dependencies {
     echo "Installing package dependencies for kayobe"
     if is_dnf; then
-        sudo dnf -y install gcc git vim python3-devel python3-pyyaml libffi-devel
+        sudo dnf -y install gcc git vim python3-devel python3-pyyaml libffi-devel python3.12-devel python3.12 python3.12-pyyaml
     elif is_yum; then
         echo "CentOS 7 is no longer supported"
         exit 1
@@ -166,7 +174,7 @@ function install_venv {
     fi
     if [[ ! -f "${venv_path}/bin/activate" ]]; then
         echo "Creating virtual environment in ${venv_path}"
-        python3 -m venv "${venv_path}"
+        $(get_python) -m venv "${venv_path}"
         # NOTE: Virtualenv's activate and deactivate scripts reference an
         # unbound variable.
         set +u
@@ -192,7 +200,9 @@ function install_venv_system_site_packages {
     fi
     if [[ ! -f "${venv_path}/bin/activate" ]]; then
         echo "Creating virtual environment in ${venv_path}"
-        python3 -m venv --system-site-packages "${venv_path}"
+        # NOTE(wszumski): tenks doesn't currently support not using the system python
+        # interpreter with: "Failed to detect selinux python bindings"
+        /usr/bin/python3 -m venv --system-site-packages "${venv_path}"
         # NOTE: Virtualenv's activate and deactivate scripts reference an
         # unbound variable.
         set +u
@@ -218,7 +228,9 @@ function install_kayobe_dev_venv {
 
 function upgrade_kayobe_venv {
     echo "Upgrading kayobe virtual environment in ${KAYOBE_VENV_PATH}"
-    python3 -m venv "${KAYOBE_VENV_PATH}"
+    # NOTE(wszumski): We need to recreate the old virtualenv to switch to python3.12
+    rm -rf "${KAYOBE_VENV_PATH}"
+    $(get_python) -m venv "${KAYOBE_VENV_PATH}"
     # NOTE: Virtualenv's activate and deactivate scripts reference an
     # unbound variable.
     set +u
diff --git a/dev/overcloud-upgrade.sh b/dev/overcloud-upgrade.sh
index cbb15855b..f8aebf06c 100755
--- a/dev/overcloud-upgrade.sh
+++ b/dev/overcloud-upgrade.sh
@@ -14,6 +14,8 @@ source "${PARENT}/functions"
 
 function main {
     config_init
+    # NOTE(wszusmki): Dependencies such as python can change across versions
+    install_dependencies
     overcloud_upgrade
 }
 
diff --git a/dev/seed-upgrade.sh b/dev/seed-upgrade.sh
index 7f51cf5a8..652efbd46 100755
--- a/dev/seed-upgrade.sh
+++ b/dev/seed-upgrade.sh
@@ -13,6 +13,8 @@ source "${PARENT}/functions"
 
 function main {
     config_init
+    # NOTE(wszusmki): Dependencies such as python can change across versions
+    install_dependencies
     seed_upgrade
 }
 
diff --git a/playbooks/kayobe-overcloud-host-configure-base/pre.yml b/playbooks/kayobe-overcloud-host-configure-base/pre.yml
index 0c521e90a..bd9599cc8 100644
--- a/playbooks/kayobe-overcloud-host-configure-base/pre.yml
+++ b/playbooks/kayobe-overcloud-host-configure-base/pre.yml
@@ -8,14 +8,25 @@
         name: python3
       become: true
 
+    - name: Install Python3.12 on RHEL derivatives
+      dnf:
+        name:
+          - python3.12
+          - python3.12-devel
+        state: latest
+      when: ansible_facts.os_family == 'RedHat'
+      become: true
+
     - name: Ensure testinfra is installed
+      vars:
+        cmd: "{{ 'python3.12' if ansible_facts.os_family == 'RedHat' else 'python3' }} -m venv"
       pip:
         name:
           - distro
           - pytest-testinfra
           - pytest-html
         virtualenv: "{{ testinfra_venv }}"
-        virtualenv_command: python3 -m venv
+        virtualenv_command: "{{ cmd }}"
 
     # NOTE(mgoddard): Use the name zzz-overrides.yml to ensure this takes
     # precedence over the standard config files and zz-overrides.yml from
diff --git a/releasenotes/notes/bump-ansible-10-2a726c83f18e34bb.yaml b/releasenotes/notes/bump-ansible-10-2a726c83f18e34bb.yaml
new file mode 100644
index 000000000..c0626e7df
--- /dev/null
+++ b/releasenotes/notes/bump-ansible-10-2a726c83f18e34bb.yaml
@@ -0,0 +1,11 @@
+---
+upgrade:
+  - |
+    Python 3.9.x is no longer supported on the control host. On Rocky Linux 9,
+    please recreate your virtualenv with ``python3.12``.
+  - |
+    Updates the maximum supported version of Ansible from 9.x (ansible-core
+    2.16) to 10.x (ansible-core 2.17). The minimum supported version is updated
+    from 8.x to 9.x. On Rocky Linux 9, you will need to recreate your Kayobe
+    virtualenv using ``python3.12`` as support for ``python3.9`` has been
+    dropped.
diff --git a/requirements.txt b/requirements.txt
index 7d7ba3710..31a3fdafa 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,10 +1,9 @@
 pbr>=2.0 # Apache-2.0
 Jinja2>3 # BSD
-ansible>=8,<10 # GPLv3
+ansible>=9,<11 # GPLv3
 cliff>=3.1.0 # Apache
 netaddr!=0.7.16,>=0.7.13 # BSD
 PyYAML>=3.10.0 # MIT
-selinux # MIT
 # INI parsing
 oslo.config>=5.2.0 # Apache-2.0
 paramiko # LGPL
diff --git a/setup.cfg b/setup.cfg
index df817dc0f..46ea41577 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -6,7 +6,7 @@ description_file =
 author = OpenStack
 author_email = openstack-discuss@lists.openstack.org
 home_page = https://docs.openstack.org/kayobe/latest/
-python_requires = >=3.8
+python_requires = >=3.10
 license = Apache License, Version 2.0
 classifier =
     Environment :: OpenStack
@@ -18,10 +18,9 @@ classifier =
     Programming Language :: Python :: Implementation :: CPython
     Programming Language :: Python :: 3 :: Only
     Programming Language :: Python :: 3
-    Programming Language :: Python :: 3.8
-    Programming Language :: Python :: 3.9
     Programming Language :: Python :: 3.10
     Programming Language :: Python :: 3.11
+    Programming Language :: Python :: 3.12
 
 [files]
 packages =
diff --git a/zuul.d/project.yaml b/zuul.d/project.yaml
index 933354699..259856e83 100644
--- a/zuul.d/project.yaml
+++ b/zuul.d/project.yaml
@@ -8,6 +8,9 @@
       - release-notes-jobs-python3
     check:
       jobs:
+        - openstack-tox-py39:
+            #NOTE(wszumski): We have dropped python3.9 support, so disable this job.
+            files: THIS-JOB-IS-DISABLED
         - kayobe-tox-ansible-syntax
         - kayobe-tox-ansible
         - kayobe-tox-molecule
@@ -33,6 +36,9 @@
         - kayobe-infra-vm-ubuntu-noble
     gate:
       jobs:
+        - openstack-tox-py39:
+            #NOTE(wszumski): We have dropped python3.9 support, so disable this job.
+            files: THIS-JOB-IS-DISABLED
         - kayobe-tox-ansible-syntax
         - kayobe-tox-ansible
         - kayobe-tox-molecule