diff --git a/.ci/azure-pipelines-steps.yml b/.ci/azure-pipelines-steps.yml
index 055e47eb..7c6bbfda 100644
--- a/.ci/azure-pipelines-steps.yml
+++ b/.ci/azure-pipelines-steps.yml
@@ -14,11 +14,15 @@ steps:
 # stuff into. The virtualenv can probably be removed again, but this was a
 # hard-fought battle and for now I am tired of this crap.
 - script: |
-    sudo ln -fs /usr/bin/python$(python.version) /usr/bin/python
     # need wheel before building virtualenv because of bdist_wheel and setuptools deps
-    /usr/bin/python -m pip install -U pip wheel setuptools
-    /usr/bin/python -m pip install -U virtualenv
-    /usr/bin/python -m virtualenv /tmp/venv -p /usr/bin/python$(python.version)
+    # Mac's System Integrity Protection prevents symlinking /usr/bin
+    # and Azure isn't allowing disabling it apparently: https://developercommunityapi.westus.cloudapp.azure.com/idea/558702/allow-disabling-sip-on-microsoft-hosted-macos-agen.html
+    (sudo ln -fs /usr/bin/python$(python.version) /usr/bin/python &&
+      /usr/bin/python -m pip install -U pip wheel setuptools &&
+      /usr/bin/python -m pip install -U virtualenv &&
+      /usr/bin/python -m virtualenv /tmp/venv -p /usr/bin/python$(python.version)) ||
+    (/usr/bin/python$(python.version) -m pip install -U pip wheel setuptools &&
+      /usr/bin/python$(python.version) -m venv /tmp/venv)
     echo "##vso[task.prependpath]/tmp/venv/bin"
 
   displayName: activate venv
diff --git a/.ci/azure-pipelines.yml b/.ci/azure-pipelines.yml
index 4a2a0566..4363b704 100644
--- a/.ci/azure-pipelines.yml
+++ b/.ci/azure-pipelines.yml
@@ -16,7 +16,7 @@ jobs:
         python.version: '2.7'
         MODE: mitogen
       Ans288_37:
-        python.version: '3.7'
+        python.version: '3'
         MODE: localhost_ansible
         VER: 2.8.8