diff --git a/install_files/ansible-base/roles/build-securedrop-app-code-deb-pkg/tasks/main.yml b/install_files/ansible-base/roles/build-securedrop-app-code-deb-pkg/tasks/main.yml
index 7e17ed787d..660dfd3c2f 100644
--- a/install_files/ansible-base/roles/build-securedrop-app-code-deb-pkg/tasks/main.yml
+++ b/install_files/ansible-base/roles/build-securedrop-app-code-deb-pkg/tasks/main.yml
@@ -29,13 +29,13 @@
 - name: Copy requirements.txt to prep directory
   command: cp "{{ securedrop_pip_requirements }}" "{{ securedrop_app_code_prep_dir }}/requirements.txt"
 
-- include: sass.yml
-
-- name: Install SecureDrop Python requirements in container
+- name: Control the version of setuptools used in the default construction of virtual environments
   shell: |
-    pip3 install --no-deps --no-binary :all: --require-hashes -r {{ securedrop_app_code_prep_dir }}/requirements.txt
-  tags:
-    - pip
+    pip3 download --require-hashes -r "{{ securedrop_app_code_prep_dir }}/requirements.txt" --dest /tmp/securedrop-app-code-requirements-download
+    rm -f /usr/share/python-wheels/setuptools-*.whl
+    mv /tmp/securedrop-app-code-requirements-download/setuptools-*.whl /usr/share/python-wheels/
+
+- include: sass.yml
 
 - include: translations.yml
 
diff --git a/install_files/ansible-base/roles/build-securedrop-app-code-deb-pkg/tasks/translations.yml b/install_files/ansible-base/roles/build-securedrop-app-code-deb-pkg/tasks/translations.yml
index 4cbd3b4114..d01a75cf79 100644
--- a/install_files/ansible-base/roles/build-securedrop-app-code-deb-pkg/tasks/translations.yml
+++ b/install_files/ansible-base/roles/build-securedrop-app-code-deb-pkg/tasks/translations.yml
@@ -1,10 +1,18 @@
 ---
 
+- name: Install SecureDrop Python requirements in virtualenv for translation work
+  shell: |
+    python3 -m venv /tmp/securedrop-app-code-i18n-ve
+    /tmp/securedrop-app-code-i18n-ve/bin/pip3 install --no-deps --no-binary :all: --require-hashes -r {{ securedrop_app_code_prep_dir }}/requirements.txt
+  tags:
+    - pip
+
 - name: Compile PO to MO.
   shell: >-
     cp config.py.example config.py ;
     trap 'rm config.py' EXIT ;
-    python3 ./i18n_tool.py --verbose translate-messages --compile
+    . /tmp/securedrop-app-code-i18n-ve/bin/activate ;
+    /tmp/securedrop-app-code-i18n-ve/bin/python3 ./i18n_tool.py --verbose translate-messages --compile
   args:
     chdir: "{{ securedrop_code_filtered }}"
   environment:
diff --git a/molecule/builder-focal/Dockerfile b/molecule/builder-focal/Dockerfile
index a75cde3029..de9b53b3fc 100644
--- a/molecule/builder-focal/Dockerfile
+++ b/molecule/builder-focal/Dockerfile
@@ -27,6 +27,7 @@ RUN apt-get -y update && apt-get upgrade -y && apt-get install -y \
         python3-all \
         python3-pip \
         python3-setuptools \
+        python3-venv \
         rsync \
         ruby \
         sqlite \
diff --git a/molecule/builder-xenial/tests/test_build_dependencies.py b/molecule/builder-xenial/tests/test_build_dependencies.py
index 23137b6241..0221ebf69e 100644
--- a/molecule/builder-xenial/tests/test_build_dependencies.py
+++ b/molecule/builder-xenial/tests/test_build_dependencies.py
@@ -4,7 +4,7 @@
 
 SECUREDROP_TARGET_PLATFORM = os.environ.get("SECUREDROP_TARGET_PLATFORM")
 SECUREDROP_PYTHON_VERSION = os.environ.get("SECUREDROP_PYTHON_VERSION", "3.5")
-SECUREDROP_DH_VIRTUALENV_VERSION = os.environ.get("SECUREDROP_DH_VIRTUALENV_VERSION", "0.11")
+
 testinfra_hosts = [
         "docker://{}-sd-app".format(SECUREDROP_TARGET_PLATFORM)
 ]
@@ -19,15 +19,6 @@ def test_sass_gem_installed(host):
     assert c.rc == 0
 
 
-def test_pip_dependencies_installed(host):
-    """
-    Ensure the development pip dependencies are installed
-    """
-    c = host.run("pip3 list installed")
-    assert "Flask-Babel" in c.stdout
-    assert c.rc == 0
-
-
 @pytest.mark.xfail(reason="This check conflicts with the concept of pegging"
                           "dependencies")
 def test_build_all_packages_updated(host):
@@ -57,6 +48,7 @@ def test_dh_virtualenv(host):
     """
     Confirm the expected version of dh-virtualenv is found.
     """
+    expected_version = "0.11" if host.system_info.codename == "xenial" else "1.2.1"
+    version_string = "dh_virtualenv {}".format(expected_version)
     c = host.run("dh_virtualenv --version")
-    version_string = "dh_virtualenv {}".format(SECUREDROP_DH_VIRTUALENV_VERSION)
     assert c.stdout.startswith(version_string)
diff --git a/molecule/builder-xenial/tests/test_securedrop_deb_package.py b/molecule/builder-xenial/tests/test_securedrop_deb_package.py
index 0f88c24b78..5b7d82e0bc 100644
--- a/molecule/builder-xenial/tests/test_securedrop_deb_package.py
+++ b/molecule/builder-xenial/tests/test_securedrop_deb_package.py
@@ -187,11 +187,10 @@ def test_deb_package_contains_mo_file(host, deb):
     Ensures the `securedrop-app-code` package has at least one
     compiled mo file.
     """
-    deb_package = host.file(deb.format(
-        securedrop_test_vars.securedrop_version))
-    c = host.run("dpkg-deb --contents {}".format(deb_package.path))
+    deb_package = host.file(deb.format(securedrop_test_vars.securedrop_version))
     # Only relevant for the securedrop-app-code package:
     if "securedrop-app-code" in deb_package.path:
+        c = host.run("dpkg-deb --contents {}".format(deb_package.path))
         assert re.search(r"^.*messages\.mo$", c.stdout, re.M)