diff --git a/tests/ansible/integration/stub_connections/_end_play_if_not_sudo_linux.yml b/tests/ansible/integration/stub_connections/_end_play_if_not_sudo_linux.yml
new file mode 100644
index 00000000..55997a72
--- /dev/null
+++ b/tests/ansible/integration/stub_connections/_end_play_if_not_sudo_linux.yml
@@ -0,0 +1,17 @@
+# End the play if we're not on Linux and a raw 'sudo' command isn't available.
+# Expects connection:local
+
+- shell: uname -s
+  register: out
+
+- meta: end_play
+  when: out.stdout != 'Linux'
+
+- command: sudo -n whoami
+  args:
+    warn: false
+  ignore_errors: true
+  register: sudo_available
+
+- meta: end_play
+  when: sudo_available.rc != 0
diff --git a/tests/ansible/integration/stub_connections/all.yml b/tests/ansible/integration/stub_connections/all.yml
index f8d5d169..9258c172 100644
--- a/tests/ansible/integration/stub_connections/all.yml
+++ b/tests/ansible/integration/stub_connections/all.yml
@@ -1,2 +1,3 @@
 - import_playbook: kubectl.yml
 - import_playbook: setns_lxc.yml
+- import_playbook: setns_lxd.yml
diff --git a/tests/ansible/integration/stub_connections/kubectl.yml b/tests/ansible/integration/stub_connections/kubectl.yml
index 13a074e1..c5768a00 100644
--- a/tests/ansible/integration/stub_connections/kubectl.yml
+++ b/tests/ansible/integration/stub_connections/kubectl.yml
@@ -4,6 +4,9 @@
   gather_facts: false
   any_errors_fatal: true
   tasks:
+  - meta: end_play
+    when: ansible_version.full < '2.5'
+
   - custom_python_detect_environment:
     vars:
       ansible_connection: kubectl
diff --git a/tests/ansible/integration/stub_connections/setns_lxc.yml b/tests/ansible/integration/stub_connections/setns_lxc.yml
index a979b1b7..19e2a984 100644
--- a/tests/ansible/integration/stub_connections/setns_lxc.yml
+++ b/tests/ansible/integration/stub_connections/setns_lxc.yml
@@ -1,4 +1,3 @@
-
 # issue #409.
 # setns is hard -- it wants to do superuser syscalls, so we must run it in a
 # child Ansible via sudo. But that only works if sudo works.
@@ -9,17 +8,7 @@
   any_errors_fatal: false
   connection: local
   tasks:
-    - setup:
-      register: out
-
-    - debug: msg={{out}}
-
-    - command: sudo -n whoami
-      args:
-        warn: false
-      ignore_errors: true
-      register: sudo_available
-      when: out.ansible_facts.ansible_system == 'Linux'
+    - include_tasks: _end_play_if_not_sudo_linux.yml
 
     - command: |
         sudo -nE ansible
@@ -39,8 +28,4 @@
       register: result
 
     - assert:
-        that: |
-          (out.ansible_facts.ansible_system != 'Linux') or
-          (sudo_available != 0) or
-          (result.rc == 0)
-
+        that: result.rc == 0
diff --git a/tests/ansible/integration/stub_connections/setns_lxd.yml b/tests/ansible/integration/stub_connections/setns_lxd.yml
new file mode 100644
index 00000000..e552a656
--- /dev/null
+++ b/tests/ansible/integration/stub_connections/setns_lxd.yml
@@ -0,0 +1,29 @@
+# issue #409.
+# setns is hard -- it wants to do superuser syscalls, so we must run it in a
+# child Ansible via sudo. But that only works if sudo works.
+
+- name: integration/stub_connections/setns_lxc.yml
+  hosts: test-targets
+  gather_facts: false
+  any_errors_fatal: false
+  connection: local
+  tasks:
+    - include_tasks: _end_play_if_not_sudo_linux.yml
+
+    - command: |
+        sudo -nE ansible
+        -i localhost,
+        -c setns
+        -e mitogen_kind=lxd
+        -e mitogen_lxc_info_path=stub-lxc.py
+        -m shell
+        -a "echo hi"
+        localhost
+      args:
+        chdir: ../..
+        warn: false
+      register: result
+
+    - assert:
+        that: result.rc == 0
+
diff --git a/tests/data/stubs/stub-lxc.py b/tests/data/stubs/stub-lxc.py
index 2fedb961..b1448bec 100755
--- a/tests/data/stubs/stub-lxc.py
+++ b/tests/data/stubs/stub-lxc.py
@@ -3,5 +3,10 @@
 import sys
 import os
 
+# setns.py fetching leader PID.
+if sys.argv[1] == 'info':
+    print 'Pid: 1'
+    sys.exit(0)
+
 os.environ['ORIGINAL_ARGV'] = repr(sys.argv)
 os.execv(sys.executable, sys.argv[sys.argv.index('--') + 1:])