diff --git a/test-requirements.txt b/test-requirements.txt
index 9c8ddfe63..04ef6c4d9 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -3,13 +3,11 @@
 # process, which may cause wedges in the gate later.
 
 # We need to pin the ansible version directly here; per the
-# deprecation policy it should trail the version used by Zuul by 4
-# weeks to give people time to update before these roles start
-# depending on new features.  Also note we can't just include zuul
-# here to pull in ansible anyway; pip doesn't actually have a
-# dependency solver and the uncapped ansible requirement from
-# ansible-lint pull in the latest version.
-ansible>=2.7,<2.8 # https://review.opendev.org/#/c/727157/
+# deprecation policy it should trail the lowest version used by Zuul
+# by 4 weeks to give people time to update before any roles start
+# depending on new features.
+
+ansible>=2.8,<2.9
 stestr>=1.0.0,<3.0.0;python_version<'3.5' # Apache-2.0
 stestr>=1.0.0;python_version>='3.5' # Apache-2.0
 
@@ -53,3 +51,6 @@ mock;python_version<'3.3'
 
 # voluptuous dropped support for py27
 voluptuous<0.13.0;python_version=='2.7'
+
+# for remove-zuul-sshkey
+paramiko