diff --git a/.zuul.yaml b/.zuul.yaml
index 13178dd6a..dcb197d23 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -5,7 +5,7 @@
     parent: legacy-dsvm-base
     vars:
       database: sql
-      python_version: py27
+      python_version: py36
       services: tempest,rabbit,mysql,key
     required-projects:
       - openstack/devstack-gate
@@ -57,7 +57,10 @@
     name: barbican-dogtag-devstack-functional-fedora-latest
     nodeset: devstack-single-node-fedora-latest
     parent: barbican-devstack-functional-base
+    # non-voting until https://pagure.io/dogtagpki/issue/3108 is fixed
+    voting: false
     vars:
+      python_version: py35
       services: barbican-dogtag,tempest,rabbit,mysql,key
       plugin: dogtag
     post-run: playbooks/legacy/barbican-devstack-functional-base/dogtag-post.yaml
@@ -179,7 +182,8 @@
       jobs:
         - barbican-simple-crypto-devstack-tempest
         - barbican-simple-crypto-devstack-functional
-        - barbican-dogtag-devstack-functional-fedora-latest
+        # TODO(redrobot): add this back once job is voting again
+        #- barbican-dogtag-devstack-functional-fedora-latest
         - barbican-vault-devstack-functional
         - barbican-grenade-devstack
     experimental:
diff --git a/barbican/plugin/dogtag.py b/barbican/plugin/dogtag.py
index 961af2373..45c48e659 100644
--- a/barbican/plugin/dogtag.py
+++ b/barbican/plugin/dogtag.py
@@ -38,6 +38,7 @@ import pki.key as key
 import pki.kra
 import pki.profile
 from requests import exceptions as request_exceptions
+import six
 
 from barbican.common import exception
 from barbican.common import utils
@@ -93,6 +94,9 @@ def _setup_nss_db_services(conf):
         return None
     if nss_password is None:
         raise ValueError(u._("nss_password is required"))
+    if type(nss_password) is not six.binary_type:
+        # Password needs to be a bytes object in Python 3
+        nss_password = nss_password.encode('UTF-8')
 
     nss_db_created = _create_nss_db_if_needed(nss_db_path, nss_password)
     crypto = cryptoutil.NSSCryptoProvider(nss_db_path, nss_password)
@@ -109,7 +113,7 @@ def _import_kra_transport_cert_to_nss_db(conf, crypto):
         systemcert_client = kraclient.system_certs
 
         transport_cert = systemcert_client.get_transport_cert()
-        crypto.import_cert(KRA_TRANSPORT_NICK, transport_cert, "u,u,u")
+        crypto.import_cert(KRA_TRANSPORT_NICK, transport_cert, ",,")
     except Exception as e:
         LOG.error("Error in importing transport cert."
                   " KRA may not be enabled: %s", e)
diff --git a/devstack/lib/barbican b/devstack/lib/barbican
index 13879a833..2adc2bbb4 100644
--- a/devstack/lib/barbican
+++ b/devstack/lib/barbican
@@ -543,7 +543,7 @@ EOF
 }
 
 function install_dogtag_plugin_dependencies {
-    install_package nss-devel 389-ds-base pki-ca pki-kra python2-pki python3-pki
+    install_package nss-devel 389-ds-base dogtag-pki
 }
 
 function install_dogtag_components {
diff --git a/playbooks/legacy/barbican-devstack-base/run.yaml b/playbooks/legacy/barbican-devstack-base/run.yaml
index ff668e0e7..c20bf53fb 100644
--- a/playbooks/legacy/barbican-devstack-base/run.yaml
+++ b/playbooks/legacy/barbican-devstack-base/run.yaml
@@ -33,7 +33,7 @@
           export PROJECTS="openstack/python-barbicanclient $PROJECTS"
           export PROJECTS="openstack/barbican-tempest-plugin $PROJECTS"
           export DEVSTACK_LOCAL_CONFIG="enable_plugin barbican https://opendev.org/openstack/barbican"
-          if [ "{{ python_version }}" == "py35" ] ; then
+          if [[ "{{ python_version }}" == py3* ]] ; then
              export DEVSTACK_GATE_USE_PYTHON3=True
              export DEVSTACK_LOCAL_CONFIG+=$'\n'"disable_service s-account"
              export DEVSTACK_LOCAL_CONFIG+=$'\n'"disable_service s-container"
diff --git a/playbooks/legacy/barbican-devstack-functional-base/run.yaml b/playbooks/legacy/barbican-devstack-functional-base/run.yaml
index eb07364ab..b9fc4fed6 100644
--- a/playbooks/legacy/barbican-devstack-functional-base/run.yaml
+++ b/playbooks/legacy/barbican-devstack-functional-base/run.yaml
@@ -46,7 +46,7 @@
           export PROJECTS="openstack/python-barbicanclient $PROJECTS"
           export PROJECTS="openstack/barbican-tempest-plugin $PROJECTS"
 
-          if [ "{{ python_version }}" == "py35" ] ; then
+          if [[ "{{ python_version }}" == py3* ]] ; then
              export DEVSTACK_GATE_USE_PYTHON3=True
           else
              export DEVSTACK_GATE_USE_PYTHON3=False
diff --git a/playbooks/legacy/barbican-devstack-tempest-base/run.yaml b/playbooks/legacy/barbican-devstack-tempest-base/run.yaml
index 24b3caef5..8d760ee9d 100644
--- a/playbooks/legacy/barbican-devstack-tempest-base/run.yaml
+++ b/playbooks/legacy/barbican-devstack-tempest-base/run.yaml
@@ -56,7 +56,7 @@
               export DEVSTACK_PROJECT_FROM_GIT="castellan"
           elif [ "{{ cursive }}" == "1" ] ; then
               export DEVSTACK_PROJECT_FROM_GIT="cursive"
-          elif [ "{{ python_version }}" == "py35" ] ; then
+          elif [[ "{{ python_version }}" == py3* ]] ; then
              export DEVSTACK_GATE_USE_PYTHON3=True
              export DEVSTACK_LOCAL_CONFIG+=$'\n'"disable_service s-account"
              export DEVSTACK_LOCAL_CONFIG+=$'\n'"disable_service s-container"