diff --git a/roles/ensure-pip/tasks/workarounds.yaml b/roles/ensure-pip/tasks/workarounds.yaml
index 5954ce4b7..d632b9a6c 100644
--- a/roles/ensure-pip/tasks/workarounds.yaml
+++ b/roles/ensure-pip/tasks/workarounds.yaml
@@ -19,19 +19,19 @@
 
 # Part of this role is exporting a working virtualenv_command for you
 # -- on Debuntu, the presence of venv (i.e. "python3 -m venv --help"
-# works) doesn't actually mean venv works ... that's just a stub that
-# will give you an error telling you the python3-venv package isn't
-# installed.
+# works) doesn't actually mean venv works.  When "python3 -m venv foo"
+# is run, venv construction will fail because the "ensurepip" module
+# is not present.
 #
 # It's quite possible we have pip and so have skipped installing from
 # packages, where we would have brought this in.  To avoid requiring
 # sudo, which is the whole point of probing for pip and skipping
-# install if we have it, we probe for the package here and only
-# install if required.
-- name: Check for python3-venv
-  command: dpkg --status python3-venv
+# install if we have it, we probe for "ensurepip" here and only
+# install the package if required.
+- name: Check for ensurepip module
+  command: python3 -m ensurepip --help
   failed_when: false
-  register: _deb_venv_pkg
+  register: _ensurepip_module
   when:
     - ansible_os_family == 'Debian'
 
@@ -42,4 +42,4 @@
   become: yes
   when:
     - ansible_os_family == 'Debian'
-    - _deb_venv_pkg.rc != 0
+    - _ensurepip_module.rc != 0
diff --git a/test-playbooks/ensure-pip-localhost.yaml b/test-playbooks/ensure-pip-localhost.yaml
new file mode 100644
index 000000000..54bff4984
--- /dev/null
+++ b/test-playbooks/ensure-pip-localhost.yaml
@@ -0,0 +1,72 @@
+- hosts: localhost
+  tasks:
+    # ensure-pip
+
+    - name: Include ensure-pip
+      include_role:
+        name: ensure-pip
+
+    - name: Create temp directory
+      tempfile:
+        state: directory
+        suffix: venv-test
+      register: _tmp_venv
+
+    - name: Sanity check provided virtualenv command installs
+      pip:
+        name: tox
+        virtualenv_command: '{{ ensure_pip_virtualenv_command }}'
+        virtualenv: '{{ _tmp_venv.path }}'
+
+    - name: Sanity check installed command runs without error
+      command: '{{ _tmp_venv.path }}/bin/tox --version'
+
+    - name: Remove tmpdir
+      file:
+        path: '{{ _tmp_venv.path }}'
+        state: absent
+
+    - name: Sanity check pip wheel generation
+      shell: |
+        cd {{ ansible_user_dir }}/src/opendev.org/zuul/zuul-client
+        # This should run anywhere without too much logic ...
+        run_pip=$(command -v pip3 || command -v pip2 || command -v pip)
+        # Preinstall pbr to work around very old distutils lacking SNI support
+        $run_pip install pbr
+        $run_pip wheel --no-deps .
+        ls zuul_client-*.whl || exit 1
+
+    - name: Test virtualenv
+      # NOTE(ianw) 2022-02-03 : not supported on 9-stream, see inline comments
+      # NOTE(frickler) 2022-03-01 : pin pluggy so as to work on Debian Buster
+      when: not (ansible_facts['distribution'] == 'CentOS' and  ansible_facts['distribution_major_version']|int >= 9)
+      block:
+        # ensure-virtualenv
+        - name: Include ensure-virtualenv
+          include_role:
+            name: ensure-virtualenv
+
+        - name: Sanity check virtualenv command works
+          shell: |
+            tmp_venv=$(mktemp -d -t venv-XXXXXXXXXX)
+            trap "rm -rf $tmp_venv" EXIT
+            virtualenv $tmp_venv
+            $tmp_venv/bin/pip install tox "pluggy<1"
+          failed_when: false
+          register: _virtualenv_sanity
+
+        - name: Assert sanity check
+          fail:
+            msg: 'The virtualenv command does not appear to work!'
+          when:
+            - _virtualenv_sanity.rc != 0
+
+# NOTE(ianw) : this does not play nicely with pip-and-virtualenv which
+# has already installed from source.  We might be able to test this
+# once it's gone...
+
+# - hosts: all
+#   roles:
+#     - role: ensure-pip
+#       vars:
+#         ensure_pip_from_upstream: True
diff --git a/zuul-tests.d/python-jobs.yaml b/zuul-tests.d/python-jobs.yaml
index 5719b8bf8..b87b692f9 100644
--- a/zuul-tests.d/python-jobs.yaml
+++ b/zuul-tests.d/python-jobs.yaml
@@ -110,6 +110,14 @@
         - name: ubuntu-jammy
           label: ubuntu-jammy
 
+- job:
+    name: zuul-jobs-test-ensure-pip-localhost
+    description: Test the ensure-pip role on the executor
+    parent: zuul-jobs-test-ensure-pip
+    run: test-playbooks/ensure-pip-localhost.yaml
+    nodeset:
+      nodes: []
+
 - job:
     name: zuul-jobs-test-ensure-sphinx
     description: Test the ensure-sphinx role
@@ -463,6 +471,7 @@
         - zuul-jobs-test-ensure-pip-ubuntu-bionic
         - zuul-jobs-test-ensure-pip-ubuntu-focal
         - zuul-jobs-test-ensure-pip-ubuntu-jammy
+        - zuul-jobs-test-ensure-pip-localhost
         - zuul-jobs-test-ensure-sphinx
         - zuul-jobs-test-ensure-tox-centos-7
         - zuul-jobs-test-ensure-tox-centos-8-stream