diff --git a/freeipa.spec.in b/freeipa.spec.in
index 03ebe29b5..21426d2ef 100644
--- a/freeipa.spec.in
+++ b/freeipa.spec.in
@@ -422,7 +422,11 @@ Summary: IPA administrative tools
 Group: System Environment/Base
 BuildArch: noarch
 Requires: %{name}-client-common = %{version}-%{release}
+%if 0%{?with_python3}
+Requires: python3-ipalib = %{version}-%{release}
+%else
 Requires: python2-ipalib = %{version}-%{release}
+%endif
 Requires: python-ldap
 
 Provides: %{alt_name}-admintools = %{version}
@@ -731,6 +735,13 @@ make client-install DESTDIR=%{buildroot}
 (cd ipapython && make PYTHON=%{__python3} IPA_VERSION_IS_GIT_SNAPSHOT=no %{?_smp_mflags} DESTDIR=%{buildroot} install)
 (cd ipaplatform && %{__python3} setup.py install --root %{buildroot})
 (cd ipaclient && %{__python3} setup.py install --root %{buildroot})
+
+# Switch shebang of /usr/bin/ipa
+# XXX: This script is installed with ipaserver. When all of ipaserver is
+# built with Python 3, this will no longer be necessary (as long as the py3
+# version is installed after the py2 version, so it overwrites /usr/bin/ipa)
+sed -i -e'1s/python\(2\|$\)/python3/' %{buildroot}%{_bindir}/ipa
+
 %endif # with_python3
 
 %find_lang %{gettext_domain}
diff --git a/ipa b/ipa
index 9ef356868..342c54147 100755
--- a/ipa
+++ b/ipa
@@ -1,4 +1,4 @@
-#!/usr/bin/python2
+#!/usr/bin/python3
 
 # Authors:
 #   Jason Gerard DeRose <jderose@redhat.com>