diff --git a/.ci/ansible_install.py b/.ci/ansible_install.py
index e63908ea..7b5d5657 100755
--- a/.ci/ansible_install.py
+++ b/.ci/ansible_install.py
@@ -12,7 +12,7 @@ batches = [
             '-r tests/requirements.txt '
             '-r tests/ansible/requirements.txt',
         # encoding is required for installing ansible 2.10 with pip2, otherwise we get a UnicodeDecode error
-        'LC_CTYPE=en_US.UTF-8 LANG=en_US.UTF-8 pip install -q ansible=={0}'.format(ci_lib.ANSIBLE_VERSION)
+        'LC_CTYPE=en_US.UTF-8 LANG=en_US.UTF-8 pip install "ansible-base<2.10.14" "ansible=={}"'.format(ci_lib.ANSIBLE_VERSION)
     ],
     [
         'aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws',
diff --git a/.ci/debops_common_install.py b/.ci/debops_common_install.py
index b5f0fae7..62519994 100755
--- a/.ci/debops_common_install.py
+++ b/.ci/debops_common_install.py
@@ -10,7 +10,7 @@ ci_lib.run_batches([
         # Must be installed separately, as PyNACL indirect requirement causes
         # newer version to be installed if done in a single pip run.
         'pip install "pycparser<2.19"',
-        'pip install -qqq debops[ansible]==2.1.2 ansible==%s' % ci_lib.ANSIBLE_VERSION,
+        'pip install -qqq "debops[ansible]==2.1.2" "ansible-base<2.10.14" "ansible=={}"'.format(ci_lib.ANSIBLE_VERSION),
     ],
     [
         'aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws',
diff --git a/.ci/localhost_ansible_install.py b/.ci/localhost_ansible_install.py
index ddeb2ae1..dba07053 100755
--- a/.ci/localhost_ansible_install.py
+++ b/.ci/localhost_ansible_install.py
@@ -12,7 +12,7 @@ batches = [
         'pip install '
             '-r tests/requirements.txt '
             '-r tests/ansible/requirements.txt',
-        'pip install -q ansible=={}'.format(ci_lib.ANSIBLE_VERSION)
+        'pip install -q "ansible-base<2.10.14" "ansible=={}"'.format(ci_lib.ANSIBLE_VERSION)
     ]
 ]