diff --git a/localhost b/localhost
index 2fbb50c..fd8a637 100644
--- a/localhost
+++ b/localhost
@@ -1 +1 @@
-localhost
+localhost ansible_python_interpreter=/usr/local/bin/python2.7
diff --git a/roles/base/tasks/ansible-pull.yml b/roles/base/tasks/ansible-pull.yml
index c62afa1..b4a0e67 100644
--- a/roles/base/tasks/ansible-pull.yml
+++ b/roles/base/tasks/ansible-pull.yml
@@ -29,11 +29,20 @@
     version: master
     accept_hostkey: yes
 
+- name: install ansible-pull cronscript
+  tags: ansible-pull
+  template:
+    src: "run-ansible-pull.sh.j2"
+    dest: "/home/{{ service_account }}/run-ansible-pull.sh"
+    mode: 0755
+    owner: "{{ service_account }}"
+    group: wheel
+
 - name: install ansible-pull crontask
   tags: ansible-pull
   cron:
     name: ansible-pull
-    job: "PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/games:/usr/local/sbin:/usr/local/bin:/home/bbinfra/bin ansible-pull -C master -d /home/{{ service_account }}/repo/ -m git -U {{ ansible_git_repository }} -o -s 3600 -i localhost --vault-password-file=/home/{{ service_account }}/.vault-password local.yml"
+    job: "/home/{{ service_account }}/run-ansible-pull.sh"
     user: "{{ service_account }}"
     minute: 0
     state: "{{ 'absent' if no_ansible_pull|default('false')|bool else 'present' }}"
diff --git a/roles/base/templates/run-ansible-pull.sh.j2 b/roles/base/templates/run-ansible-pull.sh.j2
new file mode 100644
index 0000000..90e14a2
--- /dev/null
+++ b/roles/base/templates/run-ansible-pull.sh.j2
@@ -0,0 +1,18 @@
+#! /bin/sh
+
+# set some environment variables that ansible-pull needs
+export HOME=/home/{{ service_account }}
+export PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/games:/usr/local/sbin:/usr/local/bin:/home/{{ service_account }}/bin
+
+# run ansible-pull from the directory containing the repository (and, thus, the inventory file)
+cd /home/{{ service_account}}/repo
+ansible-pull \
+    -C master \
+    -d /home/{{ service_account }}/repo/ \
+    -m git \
+    -U {{ ansible_git_repository }} \
+    -o \
+    -s 3600 \
+    -i localhost \
+    --vault-password-file=/home/{{ service_account }}/.vault-password \
+    local.yml