diff --git a/roles/certificate_watcher/tasks/main.yml b/roles/certificate_watcher/tasks/main.yml
index 38d354c..b0466d9 100644
--- a/roles/certificate_watcher/tasks/main.yml
+++ b/roles/certificate_watcher/tasks/main.yml
@@ -8,6 +8,12 @@
     system: true
     name: "{{ owner }}"
 
+- name: Setup or upgrade venv
+  become: true
+  become_user: "{{ owner }}"
+  command: python3 -m venv --upgrade-deps "$HOME/.venv/"
+  changed_when: false
+
 - name: Install certificate watcher
   pip:
     name: certificate_watcher>=0.0.5
diff --git a/roles/nginx/tasks/main.yml b/roles/nginx/tasks/main.yml
index ca4832f..c3cfeb7 100644
--- a/roles/nginx/tasks/main.yml
+++ b/roles/nginx/tasks/main.yml
@@ -6,6 +6,10 @@
     dest: /etc/ssl/certs/dhparam.pem
     mode: 0644
 
+- name: Setup or upgrade venv
+  command: python3 -m venv --upgrade-deps /root/certbot-venv/
+  changed_when: false
+
 - name: Prepare certbot+gandi venv
   pip:
     chdir: /root/