diff --git a/demo/builder-support/dockerfiles/Dockerfile.target.rocky-8 b/demo/builder-support/dockerfiles/Dockerfile.target.rocky-8
index 0138a71..0318858 100644
--- a/demo/builder-support/dockerfiles/Dockerfile.target.rocky-8
+++ b/demo/builder-support/dockerfiles/Dockerfile.target.rocky-8
@@ -7,7 +7,8 @@ FROM rockylinux:8 as dist-base
 ARG BUILDER_CACHE_BUSTER=
 #RUN dnf install -y epel-release
 # Python 3.4+ is needed for the builder helpers
-RUN dnf install -y /usr/bin/python3
+# Exactly Python 3.6 is needed for `import dnf`
+RUN dnf install -y python36
 RUN dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
 RUN dnf install -y dnf-plugins-core
 RUN dnf config-manager --set-enabled powertools
diff --git a/helpers/generate-dnf-provenance.py b/helpers/generate-dnf-provenance.py
index 507ccb6..b567d99 100755
--- a/helpers/generate-dnf-provenance.py
+++ b/helpers/generate-dnf-provenance.py
@@ -1,4 +1,4 @@
-#!/usr/bin/env python3
+#!/usr/libexec/platform-python
 """
 This script uses yum and rpm to generate in-toto material provenance and
 writes the resulting JSON to stdout or to argv[0] if provided.