diff --git a/deployed-server/scripts/enable-ssh-admin.sh b/deployed-server/scripts/enable-ssh-admin.sh
index f9b737aa25..772ee83cae 100755
--- a/deployed-server/scripts/enable-ssh-admin.sh
+++ b/deployed-server/scripts/enable-ssh-admin.sh
@@ -14,8 +14,13 @@ SSH_HOSTKEY_OPTIONS="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
 SHORT_TERM_KEY_COMMENT="TripleO split stack short term key"
 SLEEP_TIME=5
 
+# needed to handle where python lives
+function get_python() {
+  command -v python3 || command -v python2 || command -v python || exit 1
+}
+
 function overcloud_ssh_hosts_json {
-    echo "$OVERCLOUD_HOSTS" | python -c '
+    echo "$OVERCLOUD_HOSTS" | $(get_python) -c '
 from __future__ import print_function
 import json, re, sys
 print(json.dumps(re.split("\s+", sys.stdin.read().strip())))'
@@ -24,7 +29,7 @@ print(json.dumps(re.split("\s+", sys.stdin.read().strip())))'
 function overcloud_ssh_key_json {
     # we pass the contents to Mistral instead of just path, otherwise
     # the key file would have to be readable for the mistral user
-    cat "$1" | python -c 'import json,sys; print(json.dumps(sys.stdin.read()))'
+    cat "$1" | $(get_python) -c 'import json,sys; print(json.dumps(sys.stdin.read()))'
 }
 
 function workflow_finished {
diff --git a/firstboot/os-net-config-mappings.yaml b/firstboot/os-net-config-mappings.yaml
index 4ed4e2b55d..7cab34687e 100644
--- a/firstboot/os-net-config-mappings.yaml
+++ b/firstboot/os-net-config-mappings.yaml
@@ -61,10 +61,15 @@ resources:
             eth_addr=$(cat /sys/class/net/*/address | tr '\n' ',')
             mkdir -p /etc/os-net-config
 
+            # needed to handle where python lives
+            function get_python() {
+              command -v python3 || command -v python2 || command -v python || exit 1
+            }
+
             # Create an os-net-config mapping file, note this defaults to
             # /etc/os-net-config/mapping.yaml, so we use that name despite
             # rendering the result as json
-            echo '$node_lookup' | python -c "
+            echo '$node_lookup' | $(get_python) -c "
             import json
             import sys
             import copy
diff --git a/puppet/extraconfig/pre_deploy/per_node.yaml b/puppet/extraconfig/pre_deploy/per_node.yaml
index 72dc050fe0..f2d92e5b56 100644
--- a/puppet/extraconfig/pre_deploy/per_node.yaml
+++ b/puppet/extraconfig/pre_deploy/per_node.yaml
@@ -31,10 +31,14 @@ resources:
         #!/bin/sh
         node_id=$(dmidecode --s system-uuid | awk 'match($0, /[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}/) { print substr($0, RSTART, RLENGTH) }')
 
+        # needed to handle where python lives
+        function get_python() {
+          command -v python3 || command -v python2 || command -v python || exit 1
+        }
         # Create a /etc/puppet/hieradata/UUID.json file to provide
         # the data of the NodeDataLookup parameter that matches the
         # system UUID
-        echo $node_lookup | python -c "
+        echo $node_lookup | $(get_python) -c "
         import json
         import sys
         input = sys.stdin.readline() or '{}'
diff --git a/validation-scripts/all-nodes.sh b/validation-scripts/all-nodes.sh
index 2cb8a0c577..256ca10fd8 100644
--- a/validation-scripts/all-nodes.sh
+++ b/validation-scripts/all-nodes.sh
@@ -1,6 +1,11 @@
 #!/bin/bash
 set -e
 
+# needed to handle where python lives
+function get_python() {
+  command -v python3 || command -v python2 || command -v python || exit 1
+}
+
 function ping_retry() {
   local IP_ADDR=$1
   local TIMES=${2:-'10'}
@@ -33,7 +38,7 @@ function ping_controller_ips() {
       networks=$(ip r | grep -v default | cut -d " " -f 1)
     fi
     for LOCAL_NETWORK in $networks; do
-      in_network=$(python -c "import ipaddress; net=ipaddress.ip_network(u'$LOCAL_NETWORK'); addr=ipaddress.ip_address(u'$REMOTE_IP'); print(addr in net)")
+      in_network=$($(get_python) -c "import ipaddress; net=ipaddress.ip_network(u'$LOCAL_NETWORK'); addr=ipaddress.ip_address(u'$REMOTE_IP'); print(addr in net)")
       if [[ $in_network == "True" ]]; then
         echo "Trying to ping $REMOTE_IP for local network ${LOCAL_NETWORK}."
         set +e