diff --git a/global-requirements.txt b/global-requirements.txt
index ebfa155cd2..8df249ccf2 100644
--- a/global-requirements.txt
+++ b/global-requirements.txt
@@ -495,7 +495,12 @@ skydive-client  # Apache-2.0
 Yappi!=0.98,!=0.99  # MIT
 
 # NOTE(yoctozepto): To avoid repeated breakage (this is a dep of deps)
-zipp  # MIT
+# (gmann): Few branchless tools like hacking, stackviz, OpenStackSDK, and
+# Keystoneauth keeping the support of py3.5 so we need to have zipp cap for
+# < py3.6. We need to keep it until we completely drop py3.5 from OpenStack.
+# https://governance.openstack.org/tc/goals/selected/ussuri/drop-py27.html#projects-keeping-py3-5-support
+zipp<2;python_version<'3.6'  # MIT
+zipp;python_version>='3.6'  # MIT
 
 # NOTE(prometheanfire): python3 caps, are not approved for use in OpenStack
 gitdb  # BSD
diff --git a/upper-constraints.txt b/upper-constraints.txt
index f3976c6a3b..f81f232f6d 100644
--- a/upper-constraints.txt
+++ b/upper-constraints.txt
@@ -525,7 +525,10 @@ dnspython===1.16.0
 oauthlib===3.1.0
 Babel===2.8.0
 logutils===0.3.5
-zipp===3.1.0
+zipp===1.1.0;python_version=='3.5'
+zipp===3.1.0;python_version=='3.6'
+zipp===3.1.0;python_version=='3.7'
+zipp===3.1.0;python_version=='3.8'
 greenlet===0.4.15
 XStatic-Angular-Vis===4.16.0.0
 confluent-kafka===1.4.1