diff --git a/NEWS.md b/NEWS.md
index 491b9a11..8704bde5 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -1,5 +1,20 @@
 # News
 
+## 2023-12
+
+### Changes in pre-built images
+
+- For images that ship with a python environment installed, the default python
+  environment will now be a [virtual environment](https://docs.python.org/3/library/venv.html)
+  created at `/opt/venv`. ([#718](https://github.com/rocker-org/rocker-versioned2/pull/718))
+
+### Changes in rocker_scripts
+
+- `install_python.sh` will now setup a [virtual environment](https://docs.python.org/3/library/venv.html)
+  under `/opt/venv`, and this will be the default python environment (accomplished via setting
+  the `$PATH` and `$VIRTUAL_ENV` variables). `/opt/venv` will be owned by the `staff` group so non-root
+  users can safely install python packages. ([#718](https://github.com/rocker-org/rocker-versioned2/pull/718))
+
 ## 2023-11
 
 ### Changes in pre-built images
diff --git a/dockerfiles/binder_devel.Dockerfile b/dockerfiles/binder_devel.Dockerfile
index fe4710f9..591d79bc 100644
--- a/dockerfiles/binder_devel.Dockerfile
+++ b/dockerfiles/binder_devel.Dockerfile
@@ -6,6 +6,8 @@ LABEL org.opencontainers.image.licenses="GPL-2.0-or-later" \
       org.opencontainers.image.authors="Carl Boettiger <cboettig@ropensci.org>"
 
 ENV NB_USER=rstudio
+ENV VIRTUAL_ENV=/opt/venv
+ENV PATH=${VIRTUAL_ENV}/bin:${PATH}
 
 RUN /rocker_scripts/install_jupyter.sh
 
diff --git a/scripts/install_jupyter.sh b/scripts/install_jupyter.sh
index 12260fff..00db0ab2 100755
--- a/scripts/install_jupyter.sh
+++ b/scripts/install_jupyter.sh
@@ -26,8 +26,9 @@ if ! id -u "${NB_USER}" >/dev/null 2>&1; then
     /rocker_scripts/default_user.sh "${NB_USER}"
 fi
 
-# install python
-/rocker_scripts/install_python.sh
+# install python & setup venv
+# shellcheck source=/dev/null
+source /rocker_scripts/install_python.sh
 
 python3 -m pip install --no-cache-dir jupyter-rsession-proxy notebook jupyterlab jupyterhub
 
diff --git a/scripts/install_python.sh b/scripts/install_python.sh
index 1a07c23a..a2add4da 100755
--- a/scripts/install_python.sh
+++ b/scripts/install_python.sh
@@ -22,13 +22,26 @@ apt_install \
     python3-venv \
     swig
 
+# Setup a virtualenv to install things into
+
+# Put things under /opt/venv, if nothing else is specified
+export VIRTUAL_ENV="${VIRTUAL_ENV:=/opt/venv}"
+export PATH="${VIRTUAL_ENV}/bin:${PATH}"
+
+# Make sure that Rstudio sees these env vars too
+echo "PATH=${PATH}" >>"${R_HOME}/etc/Renviron.site"
+echo "VIRTUAL_ENV=${VIRTUAL_ENV}" >>"${R_HOME}/etc/Renviron.site"
+
+python3 -m venv "${VIRTUAL_ENV}"
+
+# Upgrade version of pip inside the virtualenv
 python3 -m pip --no-cache-dir install --upgrade \
     pip
 
-# Some TF tools expect a "python" binary
-if [ ! -e /usr/local/bin/python ]; then
-    ln -s "$(which python3)" /usr/local/bin/python
-fi
+# Make the venv owned by the staff group, so users can install packages
+# without having to be root
+chown -R root:staff "${VIRTUAL_ENV}"
+chmod g+ws "${VIRTUAL_ENV}"
 
 install2.r --error --skipmissing --skipinstalled -n "$NCPUS" reticulate
 
@@ -52,6 +65,12 @@ if [ "${UBUNTU_CODENAME}" == "focal" ]; then
     fi
 fi
 
+# Check that python and python3 point to correct places
+echo "Check python, python3 and pip executables point to the correct place..."
+echo "python -> $(which python)"
+echo "python3 -> $(which python3)"
+echo "pip -> $(which pip)"
+
 # Check Python version
 echo -e "Check the Python to use with reticulate...\n"
 
diff --git a/stacks/devel.json b/stacks/devel.json
index 2bb7eb26..8637af99 100644
--- a/stacks/devel.json
+++ b/stacks/devel.json
@@ -127,7 +127,9 @@
       },
       "FROM": "rocker/geospatial:devel",
       "ENV": {
-        "NB_USER": "rstudio"
+        "NB_USER": "rstudio",
+        "VIRTUAL_ENV": "/opt/venv",
+        "PATH": "${VIRTUAL_ENV}/bin:${PATH}"
       },
       "RUN": [
         "/rocker_scripts/install_jupyter.sh"