diff --git a/ansible/group_vars/baremetal.yml b/ansible/group_vars/baremetal.yml
new file mode 100644
index 0000000000..00d4ef5baa
--- /dev/null
+++ b/ansible/group_vars/baremetal.yml
@@ -0,0 +1,15 @@
+---
+ansible_python_interpreter: >-
+  {{
+    virtualenv ~ '/bin/python'
+    if virtualenv is defined
+      and virtualenv is not none
+      and virtualenv | length > 0
+    else (
+      ansible_facts.python.executable
+      if ansible_facts.python.executable is defined
+        and ansible_facts.python.executable is not none
+        and ansible_facts.python.executable | length > 0
+      else 'auto_silent'
+    )
+  }}
diff --git a/kolla_ansible/cli/commands.py b/kolla_ansible/cli/commands.py
index fbfcf02fed..7f9ecde6b0 100644
--- a/kolla_ansible/cli/commands.py
+++ b/kolla_ansible/cli/commands.py
@@ -10,6 +10,8 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+import sys
+
 from cliff.command import Command
 
 from kolla_ansible import ansible
@@ -63,6 +65,14 @@ class KollaAnsibleMixin:
         return verbosity_args
 
     def run_playbooks(self, parsed_args, *args, **kwargs):
+        # If the user knows what they're doing and explicitly sets
+        # ansible_python_interpreter, respect their choice and avoid
+        # overriding it by kolla-ansible.
+        extra = kwargs.get("extra_vars", {})
+        for var in getattr(parsed_args, "extra_vars", []) or []:
+            if var.startswith("ansible_python_interpreter="):
+                extra.pop("ansible_python_interpreter", None)
+                break
         kwargs.update(self._get_verbosity_args())
         return ansible.run_playbooks(parsed_args, *args, **kwargs)
 
@@ -153,6 +163,7 @@ class BootstrapServers(KollaAnsibleMixin, Command):
 
         extra_vars = {}
         extra_vars["kolla_action"] = "bootstrap-servers"
+        extra_vars["ansible_python_interpreter"] = "auto_silent"
 
         playbooks = _choose_playbooks(parsed_args, "kolla-host")
 
@@ -199,7 +210,9 @@ class OctaviaCertificates(KollaAnsibleMixin, Command):
         return parser
 
     def take_action(self, parsed_args):
-        extra_vars = {}
+        extra_vars = {
+            "ansible_python_interpreter": sys.executable
+        }
 
         if hasattr(parsed_args, "check_expiry") \
                 and parsed_args.check_expiry is not None:
diff --git a/releasenotes/notes/use-auto-detected-python-interpreter-for-bootstrap-b83cc25d03e4eeb5.yaml b/releasenotes/notes/use-auto-detected-python-interpreter-for-bootstrap-b83cc25d03e4eeb5.yaml
new file mode 100644
index 0000000000..7c9ebb0d23
--- /dev/null
+++ b/releasenotes/notes/use-auto-detected-python-interpreter-for-bootstrap-b83cc25d03e4eeb5.yaml
@@ -0,0 +1,8 @@
+---
+features:
+  - |
+    ``bootstrap-servers`` now always uses the system Python interpreter via
+    ``auto_silent`` autodetection.
+
+    ``octavia-certificates`` now use the same Python interpreter as the one
+    running the ``kolla-ansible`` command itself.
diff --git a/tests/test-octavia.sh b/tests/test-octavia.sh
index 10f8618b8b..311f18f2d3 100644
--- a/tests/test-octavia.sh
+++ b/tests/test-octavia.sh
@@ -11,8 +11,7 @@ export PYTHONUNBUFFERED=1
 function check_certificate_expiry {
     RAW_INVENTORY=/etc/kolla/inventory
     source $KOLLA_ANSIBLE_VENV_PATH/bin/activate
-    # NOTE(mnasiadka): Use venv python here for cryptography package (Ansible fails otherwise)
-    kolla-ansible octavia-certificates -i ${RAW_INVENTORY} --check-expiry 7 -e ansible_python_interpreter=$KOLLA_ANSIBLE_VENV_PATH/bin/python
+    kolla-ansible octavia-certificates -i ${RAW_INVENTORY} --check-expiry 7
     deactivate
 }