diff --git a/devops/scripts/boot-strap-venv.sh b/devops/scripts/boot-strap-venv.sh
index 949fca8770..0ef192bfb1 100755
--- a/devops/scripts/boot-strap-venv.sh
+++ b/devops/scripts/boot-strap-venv.sh
@@ -18,6 +18,7 @@ venv_instructions() {
 
 function virtualenv_bootstrap() {
     PYTHON_VERSION="3.8"
+    DEV_CONSTRAINT="securedrop/requirements/python3/develop-constraints.txt"
     VIRTUAL_ENV="${VIRTUAL_ENV:-}"  # Just to get around all the "set -u"
     if [ -n "$VIRTUAL_ENV" ]
     then
@@ -53,7 +54,7 @@ function virtualenv_bootstrap() {
             virtualenv -p "${p}" "${VENV}"
         fi
 
-        "${VENV}/bin/pip" install -q -r "securedrop/requirements/python3/develop-requirements.txt"
+        PIP_CONSTRAINT=${DEV_CONSTRAINT} "${VENV}/bin/pip" install -q -r "securedrop/requirements/python3/develop-requirements.txt"
 
         . "${VENV}/bin/activate"
    fi
diff --git a/securedrop/requirements/python3/develop-constraints.txt b/securedrop/requirements/python3/develop-constraints.txt
new file mode 100644
index 0000000000..5d8bef5991
--- /dev/null
+++ b/securedrop/requirements/python3/develop-constraints.txt
@@ -0,0 +1 @@
+cython < 3.0