diff --git a/tox.ini b/tox.ini
index ab4c0f28f3..5b52749eb0 100644
--- a/tox.ini
+++ b/tox.ini
@@ -26,9 +26,11 @@ setenv =
 # Add dependencies here since other jobs use python2 and zuul requires
 # python3.
 deps =
-     # Pin ansible to common version we use, otherwise ansible-lint
-     # would pull in latest version.
-     ansible>=2.7.0,<2.8
+     # ansible-lint brings in the latest version of ansible, but we
+     # keep this in sync with what Zuul uses so we don't allow though
+     # things from a later ansible that would actually fail in
+     # production.
+     ansible>=2.8,<=2.9
      ansible-lint>=4.2.0,<5
      hacking>=2.0.0,<2.1.0
      bashate>=0.2