diff --git a/playbooks/zuul/run-base-post.yaml b/playbooks/zuul/run-base-post.yaml
index 26634c7b3c..ada0e85133 100644
--- a/playbooks/zuul/run-base-post.yaml
+++ b/playbooks/zuul/run-base-post.yaml
@@ -30,7 +30,7 @@
 
     - name: Save container logs
       loop: "{{ docker_containers.stdout_lines | default([]) }}"
-      shell: "docker logs {{ item }} &> /var/log/docker/{{item}}.txt"
+      shell: "docker logs {{ item }} &> /var/log/docker/{{ item }}.txt"
       args:
         executable: /bin/bash
       become: true
diff --git a/roles/kerberos-client/tasks/main.yaml b/roles/kerberos-client/tasks/main.yaml
index 6100037f11..c71cedbae1 100644
--- a/roles/kerberos-client/tasks/main.yaml
+++ b/roles/kerberos-client/tasks/main.yaml
@@ -33,7 +33,7 @@
   vars:
     params:
       files:
-        - "{{ansible_distribution}}.yaml"
+        - "{{ ansible_distribution }}.yaml"
         - "default.yaml"
       paths:
         - install-packages
\ No newline at end of file
diff --git a/test-requirements.txt b/test-requirements.txt
index 7378380509..5f883f0871 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -4,7 +4,7 @@
 hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0
 bashate>=0.2 # Apache-2.0
 PyYAML>=3.10.0 # MIT
-ansible-lint<4.0.0
+ansible-lint>=4.1.0
 openstacksdk
 zuul-sphinx>=0.2.3
 testtools
diff --git a/tox.ini b/tox.ini
index b308646562..0f010c9df3 100644
--- a/tox.ini
+++ b/tox.ini
@@ -22,10 +22,26 @@ commands =
   #
   # ANSIBLE0010: Package installs should not use latest
   #  We often deploy latest pip packages
+  #
+  # 204: Lines < 160
+  #  Things like keys, script lines, etc exceed this.  We have good
+  #  taste and only use long lines where appropriate.
+  #
+  # 206: {{var}} should have spaces {{ var }}
+  #  This rule seems sane, but it appears there's no way to convince
+  #  ansible-lint perfectly good things that are *not* ansible (like
+  #  exim configs) in YAML shouldn't have to follow this rule.  See
+  #  https://github.com/ansible/ansible-lint/issues/534; might be able
+  #  to turn on if fixed.
+  #
+  # 306: shells with pipes should use pipefail
+  #  This requires running the shell as /bin/bash.  There is a small
+  #  possibility to hide errors, but we can rely on
+  #  developers to decide when to explicitly check for failures.
   bash -c "find roles playbooks -type f -regex '.*.y[a]?ml' -print0 | xargs -t -n1 -0 \
     ansible-lint -x ANSIBLE0004 -x ANSIBLE0006 -x ANSIBLE0007 -x ANSIBLE0010 \
                  -x ANSIBLE0011 -x ANSIBLE0012 -x ANSIBLE0013 -x ANSIBLE0015 \
-                 -x 304"
+                 -x 204 -x 206 -x 304 -x 306"
 
 [testenv:venv]
 commands = {posargs}