diff --git a/.azure-pipelines/templates/steps/tox-steps.yml b/.azure-pipelines/templates/steps/tox-steps.yml
index e7f3ac70c..44343f94d 100644
--- a/.azure-pipelines/templates/steps/tox-steps.yml
+++ b/.azure-pipelines/templates/steps/tox-steps.yml
@@ -26,7 +26,8 @@ steps:
       addToPath: true
   - bash: |
       set -e
-      python3 tools/pip_install.py tox
+      python3 -m venv venv
+      venv/bin/python tools/pip_install.py tox
     displayName: Install runtime dependencies
   - task: DownloadSecureFile@1
     name: testFarmPem
@@ -38,7 +39,7 @@ steps:
       export TARGET_BRANCH="`echo "${BUILD_SOURCEBRANCH}" | sed -E 's!refs/(heads|tags)/!!g'`"
       [ -z "${SYSTEM_PULLREQUEST_TARGETBRANCH}" ] || export TARGET_BRANCH="${SYSTEM_PULLREQUEST_TARGETBRANCH}"
       env
-      python3 -m tox
+      venv/bin/python -m tox
     env:
       AWS_ACCESS_KEY_ID: $(AWS_ACCESS_KEY_ID)
       AWS_SECRET_ACCESS_KEY: $(AWS_SECRET_ACCESS_KEY)
@@ -48,7 +49,7 @@ steps:
     # status code to prevent problems here from causing build failures.  If
     # this turns out to work well, we can change this.
   - bash: |
-      python3 tools/pip_install.py -I coverage
+      venv/bin/python tools/pip_install.py -I coverage
       case "$AGENT_OS" in
         Darwin)
           CODECOV_URL="https://uploader.codecov.io/latest/macos/codecov"