diff --git a/roles/ensure-virtualenv/tasks/Debian.yaml b/roles/ensure-virtualenv/tasks/Debian.yaml
index b2d498b0b..95c728bf6 100644
--- a/roles/ensure-virtualenv/tasks/Debian.yaml
+++ b/roles/ensure-virtualenv/tasks/Debian.yaml
@@ -1,3 +1,14 @@
+# The pip that comes with Xenial (v8) does not understand how to
+# fallback to pypi in the OpenDev mirror setup.  The virtualenv
+# package tries to use the system pip to bootstrap the environment it
+# creates, and thus the xenial packaged virtualenv can not create a
+# working environment.  We pre-run ensure-pip there to bring in our
+# backported pip9 and make this work.
+- name: ensure-pip for Xenial
+  include_role:
+    name: ensure-pip
+  when: ansible_distribution_release == 'xenial'
+
 - name: Install virtualenv
   package:
     name: