diff --git a/ansible/install/roles/rally/tasks/main.yml b/ansible/install/roles/rally/tasks/main.yml
index 7376c4275..0f211b69a 100644
--- a/ansible/install/roles/rally/tasks/main.yml
+++ b/ansible/install/roles/rally/tasks/main.yml
@@ -15,6 +15,16 @@
     line: 'export REQUESTS_CA_BUNDLE={{ overcloud_ca_path }}'
   when: overcloud_ca_path is defined
 
+- name: Upgrade pip if it is old
+  shell: |
+    source "{{ rally_venv }}/bin/activate"
+    if [ "$(pip --version | cut -d' ' -f2 | cut -d'.' -f1)" -lt "19" ]; then
+       pip install --upgrade 'pip<20'
+    fi
+  args:
+    executable: /bin/bash
+    chdir: "{{ browbeat_path }}"
+
 - name: Install rally-requirements into rally-venv
   pip:
     requirements: "{{ browbeat_path }}/tools-requirements.txt"
diff --git a/requirements.txt b/requirements.txt
index dc315eabd..6d9637c93 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -8,4 +8,6 @@ grafyaml>=0.0.7
 openstacksdk
 python-dateutil>=2.4.2
 python-openstackclient>=3.11.0
-pykwalify>=1.6.0
+pykwalify==1.7.0;python_version<'3'
+pykwalify>=1.8.0;python_version>='3'
+
diff --git a/test-requirements.txt b/test-requirements.txt
index 1b3f57c26..b26752d1a 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -5,7 +5,8 @@
 hacking>=3.0.1,<3.1.0;python_version>='3' # Apache-2.0
 hacking>=1.1.0,<1.2.0;python_version<'3' # Apache-2.0
 
-pykwalify
+pykwalify==1.7.0;python_version<'3'
+pykwalify>=1.8.0;python_version>='3'
 coverage>=3.6
 pre-commit  # MIT
 pyrsistent==0.16.0;python_version<'3'