diff --git a/roles/ensure-pip/tasks/main.yaml b/roles/ensure-pip/tasks/main.yaml
index 8c572d6cd..65a54ecf9 100644
--- a/roles/ensure-pip/tasks/main.yaml
+++ b/roles/ensure-pip/tasks/main.yaml
@@ -58,21 +58,29 @@
 - name: Set host default
   set_fact:
     _host_virtualenv: '{{ (_venv_probe.rc == 0) | ternary("/usr/bin/python3 -m venv", "virtualenv") }}'
-  when: ansible_distribution_release != 'xenial'
-
-# The pip included with Xenial (version ~8) has issues with our wheel
-# mirrors; it will not correctly look to upstream pypi when it can't
-# find the wheel in the configured mirror, so virutalenv creation
-# fails.  venv uses the system pip version; for this reason we need to
-# use virtualenv which does upgrade pip in the environment; but note
-# that on Xenial "virtualenv" is owned by the python2 package; so we
-# specify the command to python3 directly.
-- name: Set host default (Xenial)
-  set_fact:
-    _host_virtualenv: '/usr/bin/python3 -m virtualenv'
-  when: ansible_distribution_release == 'xenial'
 
 - name: Set ensure_pip_virtualenv_cmd
   set_fact:
     ensure_pip_virtualenv_command: '{{ ensure_pip_virtualenv_command | default(_host_virtualenv) }}'
     cacheable: true
+
+# NOTE(ianw): "python3 -m venv" is broken on Xenial images with
+# pip-and-virtualenv because the pip is too old to handle our mirrors.
+# We can't easily install our backport version because that element
+# has put all the packages on hold.  In this case, export
+# ensure_pip_virtualenv_command as virtualenv until we have got rid of
+# this element.
+- name: Xenial override
+  when: ansible_distribution_release == 'xenial'
+  block:
+
+    - name: Check if we have pip-and-virtualenv
+      command: grep -q 'pip-and-virtualenv' /etc/dib-manifests/dib_environment
+      failed_when: false
+      register: _pip_check
+      become: yes
+
+    - name: Override virtualenv
+      set_fact:
+        ensure_pip_virtualenv_command: 'virtualenv -p python3'
+      when: _pip_check.rc == 0
diff --git a/roles/ensure-pip/tasks/xenial.yaml b/roles/ensure-pip/tasks/xenial.yaml
index 1b4b63b70..6e7817ebf 100644
--- a/roles/ensure-pip/tasks/xenial.yaml
+++ b/roles/ensure-pip/tasks/xenial.yaml
@@ -1,4 +1,10 @@
-# See notes in main.yaml about the virtualenv requirements
+# Pip 8 as shipped with Xenial doesn't correctly fall back to pypi
+# when setup to point to infra mirrors.  This PPA has a backport of of
+# the Bionic 9 pip which means we ship a working environment at least.
+- name: Install backport pip
+  apt_repository:
+    repo: ppa:openstack-ci-core/python-pip
+  become: yes
 
 - name: Install Python 3 pip
   package:
@@ -6,7 +12,6 @@
       - python3-pip
       - python3-setuptools
       - python3-venv
-      - python3-virtualenv
   become: yes
 
 - name: Install Python 2 pip
@@ -14,7 +19,13 @@
     name:
       - python-setuptools
       - python-pip
-      - python-virtualenv
   become: yes
-  when: (ensure_pip_from_packages_with_python2) or
-        (ansible_python.version.major == 2)
+  when: ensure_pip_from_packages_with_python2
+
+# Remove the PPA to avoid exposing future job apt-get updates to ppa
+# latency.  The packages remain.
+- name: Remove backport pip repo
+  apt_repository:
+    repo: ppa:openstack-ci-core/python-pip
+    state: absent
+  become: yes