diff --git a/bindep.txt b/bindep.txt
index 8b8b6806e6c..aeb6c742422 100644
--- a/bindep.txt
+++ b/bindep.txt
@@ -4,6 +4,10 @@
 # tools/misc-sanity-checks.sh validates .po[t] files
 gettext [test]
 
+# cffi (required by oslo.privsep) and PyNaCL (required by paramiko)
+libffi-dev [platform:dpkg]
+libffi-devel [platform:rpm]
+
 # MySQL and PostgreSQL databases since some jobs are set up in
 # OpenStack infra that need these like
 # periodic-neutron-py27-with-oslo-master and