diff --git a/roles/run-heat-tests/defaults/main.yaml b/roles/run-heat-tests/defaults/main.yaml
index b601d49d9e..22ce4a4903 100644
--- a/roles/run-heat-tests/defaults/main.yaml
+++ b/roles/run-heat-tests/defaults/main.yaml
@@ -1,2 +1,5 @@
 devstack_base_dir: /opt/stack
 tempest_test_timeout: ''
+tempest_tox_environment: {}
+heat_tempest_plugin: /opt/stack/heat-tempest-plugin
+constraints_file: /opt/stack/requirements/upper-constraints.txt
diff --git a/roles/run-heat-tests/tasks/main.yaml b/roles/run-heat-tests/tasks/main.yaml
index 75122f2a1b..4af1d0e03a 100644
--- a/roles/run-heat-tests/tasks/main.yaml
+++ b/roles/run-heat-tests/tasks/main.yaml
@@ -1,3 +1,23 @@
+- name: Set OS_TEST_TIMEOUT if requested
+  set_fact:
+    tempest_tox_environment: "{{ tempest_tox_environment | combine({'OS_TEST_TIMEOUT': tempest_test_timeout}) }}"
+  when: tempest_test_timeout != ''
+
+- name: Set TOX_CONSTRAINTS_FILE
+  set_fact:
+    tempest_tox_environment: "{{ tempest_tox_environment | combine({'UPPER_CONSTRAINTS_FILE': constraints_file}) | combine({'TOX_CONSTRAINTS_FILE': constraints_file}) }}"
+
+- name: Allow git to read plugin directories
+  become: true
+  command: git config --system --add safe.directory {{heat_tempest_plugin}}
+
+- name: Install plugins
+  command: tox -evenv-tempest -- pip install -c{{constraints_file}} {{heat_tempest_plugin}}
+  become: true
+  args:
+    chdir: "{{devstack_base_dir}}/tempest"
+  environment: "{{ tempest_tox_environment }}"
+
 - name: Run heat tests
   command: tox -evenv-tempest -- stestr --test-path={{devstack_base_dir}}/heat/heat_integrationtests \
             --top-dir={{devstack_base_dir}}/heat \
@@ -5,5 +25,4 @@
   args:
     chdir: "{{devstack_base_dir}}/tempest"
   become: true
-  become_user: tempest
-  environment: '{{ {"OS_TEST_TIMEOUT": tempest_test_timeout} if tempest_test_timeout else {} }}'
+  environment: "{{ tempest_tox_environment }}"