diff --git a/roles/ensure-pip/tasks/Debian.yaml b/roles/ensure-pip/tasks/Debian.yaml
index ad7c4163d..d70a07552 100644
--- a/roles/ensure-pip/tasks/Debian.yaml
+++ b/roles/ensure-pip/tasks/Debian.yaml
@@ -3,6 +3,7 @@
     name:
       - python3-pip
       - python3-setuptools
+      - python3-venv
   become: yes
 
 - name: Install Python 2 pip
diff --git a/roles/ensure-pip/tasks/RedHat.yaml b/roles/ensure-pip/tasks/RedHat.yaml
index 33fb01f77..4f9021baf 100644
--- a/roles/ensure-pip/tasks/RedHat.yaml
+++ b/roles/ensure-pip/tasks/RedHat.yaml
@@ -34,6 +34,7 @@
     name:
       - python-pip
       - python-setuptools
+      - python-virtualenv
     state: present
   become: yes
   when: (ensure_pip_from_packages_with_python2) or
diff --git a/roles/ensure-pip/tasks/main.yaml b/roles/ensure-pip/tasks/main.yaml
index 3c6e72f22..74df1d9c0 100644
--- a/roles/ensure-pip/tasks/main.yaml
+++ b/roles/ensure-pip/tasks/main.yaml
@@ -29,6 +29,7 @@
 - name: Install pip from packages
   include: "{{ item }}"
   with_first_found:
+    - "{{ ansible_distribution_release }}.yaml"
     - "{{ ansible_distribution }}.yaml"
     - "{{ ansible_os_family }}.yaml"
     - "default.yaml"
@@ -41,3 +42,34 @@
   when:
     - ensure_pip_from_upstream
     - pip_preinstalled.rc != 0
+
+#
+# virtualenv setup
+#
+- name: Probe for venv
+  command: /usr/bin/python3 -m venv --help
+  no_log: True
+  failed_when: false
+  register: _venv_probe
+
+- name: Set host default
+  set_fact:
+    _host_virtualenv: '{{ (_venv_probe.rc == 0) | ternary("/usr/bin/python3 -m venv", "virtualenv") }}'
+  when: ansible_distribution_release != 'xenial'
+
+# The pip included with Xenial (version ~8) has issues with our wheel
+# mirrors; it will not correctly look to upstream pypi when it can't
+# find the wheel in the configured mirror, so virutalenv creation
+# fails.  venv uses the system pip version; for this reason we need to
+# use virtualenv which does upgrade pip in the environment; but note
+# that on Xenial "virtualenv" is owned by the python2 package; so we
+# specify the command to python3 directly.
+- name: Set host default (Xenial)
+  set_fact:
+    _host_virtualenv: '/usr/bin/python3 -m virtualenv'
+  when: ansible_distribution_release == 'xenial'
+
+- name: Set ensure_pip_virtualenv_cmd
+  set_fact:
+    ensure_pip_virtualenv_command: '{{ ensure_pip_virtualenv_command | default(_host_virtualenv) }}'
+    cacheable: true
diff --git a/roles/ensure-pip/tasks/xenial.yaml b/roles/ensure-pip/tasks/xenial.yaml
new file mode 100644
index 000000000..1b4b63b70
--- /dev/null
+++ b/roles/ensure-pip/tasks/xenial.yaml
@@ -0,0 +1,20 @@
+# See notes in main.yaml about the virtualenv requirements
+
+- name: Install Python 3 pip
+  package:
+    name:
+      - python3-pip
+      - python3-setuptools
+      - python3-venv
+      - python3-virtualenv
+  become: yes
+
+- name: Install Python 2 pip
+  package:
+    name:
+      - python-setuptools
+      - python-pip
+      - python-virtualenv
+  become: yes
+  when: (ensure_pip_from_packages_with_python2) or
+        (ansible_python.version.major == 2)
diff --git a/test-playbooks/ensure-pip.yaml b/test-playbooks/ensure-pip.yaml
index 6b83580e6..8fb39a02c 100644
--- a/test-playbooks/ensure-pip.yaml
+++ b/test-playbooks/ensure-pip.yaml
@@ -1,6 +1,21 @@
 - hosts: all
   roles:
     - ensure-pip
+  tasks:
+    - name: Sanity check provided virtualenv command works
+      shell: |
+        tmp_venv=$(mktemp -d -t venv-XXXXXXXXXX)
+        trap "rm -rf $tmp_venv" EXIT
+        {{ ensure_pip_virtualenv_command }} $tmp_venv
+        $tmp_venv/bin/pip install tox
+      failed_when: false
+      register: _venv_sanity
+
+    - name: Assert sanity check
+      fail:
+        msg: 'The virtualenv_command: "{{ ensure_pip_virtualenv_command }}" does not appear to work!'
+      when:
+        - _venv_sanity.rc != 0
 
 # NOTE(ianw) : this does not play nicely with pip-and-virtualenv which
 # has already installed from source.  We might be able to test this