diff --git a/test-requirements.txt b/test-requirements.txt
index 339e2142c..d7feb5675 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -3,9 +3,14 @@
 # process, which may cause wedges in the gate later.
 flake8
 
-# We need to pin Ansible to <2.4 until Zuul supports it, otherwise ansible-lint
-# picks the latest version which is not known to work yet.
-ansible<2.4
+# We need to pin the ansible version directly here; per the
+# deprecation policy it should trail the version used by Zuul by 4
+# weeks to give people time to update before these roles start
+# depending on new features.  Also note we can't just include zuul
+# here to pull in ansible anyway; pip doesn't actually have a
+# dependency solver and the uncapped ansible requirement from
+# ansible-lint pull in the latest version.
+ansible>=2.5.1,<2.6 # https://review.openstack.org/567007
 ansible-lint
 bashate>=0.2
 zuul-sphinx>=0.1.1
@@ -15,4 +20,3 @@ openstacksdk>=0.17.1
 requests
 requestsexceptions
 bs4
-#