diff --git a/lib/tempest b/lib/tempest
index 7bc0bd5a21..011d0a1cb3 100644
--- a/lib/tempest
+++ b/lib/tempest
@@ -589,9 +589,8 @@ function configure_tempest {
         tox -revenv-tempest --notest
     fi
 
-    # The requirements might be on a different branch, while tempest needs master requirements.
-    (cd $REQUIREMENTS_DIR && git show origin/master:upper-constraints.txt) > u-c-m.txt
-    tox -evenv-tempest -- pip install -c u-c-m.txt -r requirements.txt
+    # NOTE(gmann): Use branch constraint because Tempest is pinned to the branch release instead of using master.
+    tox -evenv-tempest -- pip install -c $REQUIREMENTS_DIR/upper-constraints.txt -r requirements.txt
 
     # Auth:
     iniset $TEMPEST_CONFIG auth tempest_roles "Member"
@@ -692,6 +691,17 @@ function install_tempest {
     git_clone $TEMPEST_REPO $TEMPEST_DIR $TEMPEST_BRANCH
     pip_install 'tox!=2.8.0'
     pushd $TEMPEST_DIR
+    # NOTE(gmann): checkout the TEMPEST_BRANCH in case TEMPEST_BRANCH
+    # is tag name not master. git_clone would not checkout tag because
+    # TEMPEST_DIR already exist until RECLONE is true.
+    git checkout $TEMPEST_BRANCH
+
+    # NOTE(gmann): Use branch constraint because Tempest is pinned to the branch release
+    # instead of using master. We need to export it via env var UPPER_CONSTRAINTS_FILE
+    # so that initial creation of tempest tox use stable branch constraint
+    # instead of master constraint as defined in tempest/tox.ini
+    export UPPER_CONSTRAINTS_FILE=$REQUIREMENTS_DIR/upper-constraints.txt
+
     tox -r --notest -efull
     local ver
     ver=$(tox -evenv-tempest -- python --version)
@@ -712,9 +722,9 @@ function install_tempest {
 function install_tempest_plugins {
     pushd $TEMPEST_DIR
     if [[ $TEMPEST_PLUGINS != 0 ]] ; then
-        # The requirements might be on a different branch, while tempest & tempest plugins needs master requirements.
-        (cd $REQUIREMENTS_DIR && git show origin/master:upper-constraints.txt) > u-c-m.txt
-        tox -evenv-tempest -- pip install -c u-c-m.txt $TEMPEST_PLUGINS
+        # NOTE(gmann): Use branch constraint because Tempest is pinned to the branch release
+        # instead of using master.
+        tox -evenv-tempest -- pip install -c $REQUIREMENTS_DIR/upper-constraints.txt $TEMPEST_PLUGINS
         echo "Checking installed Tempest plugins:"
         tox -evenv-tempest -- tempest list-plugins
     fi
diff --git a/stackrc b/stackrc
index c39809c28f..33c2698b67 100644
--- a/stackrc
+++ b/stackrc
@@ -310,8 +310,10 @@ REQUIREMENTS_BRANCH=${REQUIREMENTS_BRANCH:-$TARGET_BRANCH}
 
 # Tempest test suite
 TEMPEST_REPO=${TEMPEST_REPO:-${GIT_BASE}/openstack/tempest.git}
-TEMPEST_BRANCH=${TEMPEST_BRANCH:-$BRANCHLESS_TARGET_BRANCH}
-
+# Use Tempest tag 23.0.0) which is Rocky supported version for
+# Xenial jobs running on py3.5.
+# https://docs.openstack.org/releasenotes/tempest/v23.0.0.html
+TEMPEST_BRANCH=${TEMPEST_BRANCH:-23.0.0}
 
 ##############
 #
diff --git a/tests/test_refs.sh b/tests/test_refs.sh
index 0f9aa4a5ca..1bd3a8b5af 100755
--- a/tests/test_refs.sh
+++ b/tests/test_refs.sh
@@ -15,7 +15,7 @@
 
 echo "Ensuring we don't have crazy refs"
 
-REFS=`grep BRANCH stackrc | grep -v 'TARGET_BRANCH' | grep -v 'NOVNC_BRANCH'`
+REFS=`grep BRANCH stackrc | grep -v 'TARGET_BRANCH' | grep -v 'NOVNC_BRANCH' | grep -v TEMPEST_BRANCH`
 rc=$?
 if [[ $rc -eq 0 ]]; then
     echo "Branch defaults must be one of the *TARGET_BRANCH values. Found:"