diff --git a/playbooks/bridge.yaml b/playbooks/bridge.yaml
index 08305f6eaf..407617eb87 100644
--- a/playbooks/bridge.yaml
+++ b/playbooks/bridge.yaml
@@ -12,12 +12,12 @@
     #  install_ansible_version: '{{ bridge_ansible_version | default(None) }}'
     - role: install-ansible
       install_ansible_name: '{{ bridge_ansible_name | default("ansible") }}'
-      install_ansible_version: '{{ bridge_ansible_version | default("2.7.3") }}'
+      install_ansible_version: '{{ bridge_ansible_version | default("2.8.0") }}'
       install_ansible_openstacksdk_name: '{{ bridge_openstacksdk_name | default("openstacksdk") }}'
       install_ansible_openstacksdk_version: '{{ bridge_openstacksdk_verison | default("latest") }}'
       # NOTE(ianw): At 2018-12, ARA is only enabled during gate
       # testing jobs as we decide if or how to store data on
       # production bridge.o.o
       install_ansible_ara_name: '{{ bridge_ara_name | default("ara") }}'
-      install_ansible_ara_version: '{{ bridge_ara_version | default("0.16.1") }}'
+      install_ansible_ara_version: '{{ bridge_ara_version | default("0.16.4") }}'
     - root-keys
diff --git a/playbooks/roles/letsencrypt-create-certs/handlers/main.yaml b/playbooks/roles/letsencrypt-create-certs/handlers/main.yaml
index 4a71761cdf..5cf34d864d 100644
--- a/playbooks/roles/letsencrypt-create-certs/handlers/main.yaml
+++ b/playbooks/roles/letsencrypt-create-certs/handlers/main.yaml
@@ -7,32 +7,31 @@
 #
 # listen: letsencrypt updated letsencrypt01-main-service
 #
-# doesn't actually register the handler.  May be a bug or a feature to
-# do with import_tasks; currently unsure.
+# doesn't actually register the handler.
 
 - name: letsencrypt updated graphite01-main
-  import_tasks: touch_file.yaml
+  include_tasks: roles/letsencrypt-create-certs/handlers/touch_file.yaml
   vars:
     touch_file: '/tmp/letsencrypt-graphite01-main.stamp'
 
 - name: letsencrypt updated mirror01-dfw-rax-main
-  import_tasks: restart_apache.yaml
+  include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
 
 # Gate testing hosts:
 - name: letsencrypt updated letsencrypt01-main-service
-  import_tasks: touch_file.yaml
+  include_tasks: roles/letsencrypt-create-certs/handlers/touch_file.yaml
   vars:
     touch_file: '/tmp/letsencrypt01-main-service.stamp'
 
 - name: letsencrypt updated letsencrypt01-other-service
-  import_tasks: touch_file.yaml
+  include_tasks: roles/letsencrypt-create-certs/handlers/touch_file.yaml
   vars:
     touch_file: '/tmp/letsencrypt01-other-service.stamp'
 
 - name: letsencrypt updated letsencrypt02-main-service
-  import_tasks: touch_file.yaml
+  include_tasks: roles/letsencrypt-create-certs/handlers/touch_file.yaml
   vars:
     touch_file: '/tmp/letsencrypt02-main-service.stamp'
 
 - name: letsencrypt updated mirror01-region-provider-opendev-org-main
-  import_tasks: restart_apache.yaml
+  include_tasks: roles/letsencrypt-create-certs/handlers/restart_apache.yaml
diff --git a/test-requirements.txt b/test-requirements.txt
index 9dcf3a5a32..7378380509 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -9,8 +9,13 @@ openstacksdk
 zuul-sphinx>=0.2.3
 testtools
 mock
-# Ansible 2.8 drops the paramiko dep which breaks testinfra
-ansible<2.8.0
 # testinfra 1.17.0 has a broken wheel that won't install under python3
 # testinfra 3.0.0 switched the ansible backend, but broke ipv6 handling
 testinfra!=1.17.0,!=3.0.0
+# testinfra's ansible backend actually requires paramiko, but it's not
+# specified.  After
+#  https://github.com/philpep/testinfra/pull/454
+# releases we can do testinfra[ansible] here instead
+ansible>=2.8.0
+paramiko
+