diff --git a/docker/services/neutron-sriov-agent.yaml b/docker/services/neutron-sriov-agent.yaml
index bcce398428..7703ac5fa5 100644
--- a/docker/services/neutron-sriov-agent.yaml
+++ b/docker/services/neutron-sriov-agent.yaml
@@ -141,9 +141,19 @@ outputs:
                       owner: root
                       group: root
                       mode: 0750
+                  # in queens, ansible "host_tasks" are executed inside the overcloud node via os-collect-config
+                  # in later versions (with config download), ansible is executed from the undercloud
+                  # so in queens, abosolute path in the undercloud cannot be provided, instead file content is copied
                   - name: derive pci passthrough whitelist
                     copy:
-                      src: /usr/share/openstack-tripleo-heat-templates/docker/services/derive_pci_passthrough_whitelist.py
+                      content:
+                        str_replace:
+                          template: |
+                            {% raw -%}
+                            _DERIVE_CONTENT_
+                            {% endraw %}
+                          params:
+                            _DERIVE_CONTENT_: {get_file: ./derive_pci_passthrough_whitelist.py}
                       dest: /var/lib/pci_passthrough_whitelist_scripts/derive_pci_passthrough_whitelist.py
                       mode: 0700
                   - name: run derive_pci_passthrough_whitelist.py