diff --git a/Dockerfile b/Dockerfile
index c0ec0b4..a72e60a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -57,7 +57,7 @@ COPY ./root/ /
 # - In order to drop the root user, we have to make some directories world
 #   writable as OpenShift default security model is to run the container
 #   under random UID.
-RUN virtualenv ${APP_ROOT} && \
+RUN python3.7 -m venv ${APP_ROOT} && \
 chown -R 1001:0 ${APP_ROOT} && \
 fix-permissions ${APP_ROOT} -P
 
diff --git a/README.md b/README.md
index 5802aee..bed4564 100644
--- a/README.md
+++ b/README.md
@@ -22,7 +22,9 @@ Python's elegant syntax and dynamic typing, together with its interpreted nature
 make it an ideal language for scripting and rapid application development in many areas 
 on most platforms.
 
-This container image includes an npm utility, so users can use it to install JavaScript
+This container image includes an npm utility
+(see [base image repository](https://github.com/sclorg/s2i-base-container/tree/master/base)),
+so users can use it to install JavaScript
 modules for their web applications. There is no guarantee for any specific npm or nodejs
 version, that is included in the image; those versions can be changed anytime and
 the nodejs itself is included just to make the npm work.
@@ -35,7 +37,7 @@ Building a simple [python-sample-app](https://github.com/sclorg/s2i-python-conta
 in Openshift can be achieved with the following step:
 
     ```
-    oc new-app python:3.6~https://github.com/sclorg/s2i-python-container.git --context-dir=3.7/test/setup-test-app/
+    oc new-app python:3.7~https://github.com/sclorg/s2i-python-container.git --context-dir=3.7/test/setup-test-app/
     ```
 
 The same application can also be built using the standalone [S2I](https://github.com/openshift/source-to-image) application on systems that have it available:
diff --git a/s2i/bin/assemble b/s2i/bin/assemble
index 26fcf6d..68618a7 100755
--- a/s2i/bin/assemble
+++ b/s2i/bin/assemble
@@ -9,13 +9,9 @@ function should_collectstatic() {
 }
 
 function virtualenv_bin() {
-  if head "/etc/redhat-release" | grep -q "^CentOS Linux release 7" || \
-     head "/etc/redhat-release" | grep -q "^Red Hat Enterprise Linux\( Server\)\? release 7" || \
-     head "/etc/redhat-release" | grep -q "^Fedora release"; then
-    virtualenv $1
-  else
-    virtualenv-${PYTHON_VERSION} $1
-  fi
+    # New versions of Python (>3.6) should use venv module
+    # from stdlib instead of virtualenv package
+    python3.7 -m venv $1
 }
 
 # Install pipenv to the separate virtualenv to isolate it
diff --git a/test/django-test-app/requirements.txt b/test/django-test-app/requirements.txt
index d0d5a26..1f45a73 100644
--- a/test/django-test-app/requirements.txt
+++ b/test/django-test-app/requirements.txt
@@ -1 +1 @@
-Django==1.11.23
+Django==1.11.28
diff --git a/test/test-lib-openshift.sh b/test/test-lib-openshift.sh
index f62eab6..89fc1cf 100644
--- a/test/test-lib-openshift.sh
+++ b/test/test-lib-openshift.sh
@@ -290,8 +290,7 @@ function ct_os_new_project() {
     oc create -f "$OPENSHIFT_CLUSTER_PULLSECRET_PATH"
     # add registry pullsecret to the serviceaccount if provided
     secret_name=$(grep '^\s*name:' "$OPENSHIFT_CLUSTER_PULLSECRET_PATH" | awk '{ print $2 }')
-    secret_json='{"imagePullSecrets": [{"name": "'${secret_name}'"}]}'
-    oc patch serviceaccount default -p "$secret_json"
+    oc secrets link --for=pull default "$secret_name"
   fi
 }
 
@@ -597,15 +596,14 @@ function ct_os_test_s2i_app_func() {
   if [ "${CT_SKIP_UPLOAD_IMAGE:-false}" == 'true' ] ; then
     if [ -n "${import_image}" ] ; then
       echo "Importing image ${import_image} as ${image_name}:${VERSION}"
-      oc import-image "${image_name}":"${VERSION}" --from "${import_image}" --confirm
+      # Use --reference-policy=local to pull remote image content to the cluster
+      # Works around the issue of builder pods not having access to registry.redhat.io
+      oc import-image "${image_name}":"${VERSION}" --from "${import_image}" --confirm --reference-policy=local
     else
       echo "Uploading and importing image skipped."
     fi
   else
-    if [ -n "${import_image}" ] ; then
-      echo "Warning: Import image ${import_image} requested, but uploading image ${image_name} instead."
-    fi
-    ct_os_upload_image "${image_name}" "${image_tagged}"
+    ct_os_upload_image "${import_image:-$image_name}" "${image_tagged}"
   fi
 
   local app_param="${app}"
@@ -728,15 +726,14 @@ function ct_os_test_template_app_func() {
   if [ "${CT_SKIP_UPLOAD_IMAGE:-false}" == 'true' ] ; then
     if [ -n "${import_image}" ] ; then
       echo "Importing image ${import_image} as ${image_name}:${VERSION}"
-      oc import-image "${image_name}":"${VERSION}" --from "${import_image}" --confirm
+      # Use --reference-policy=local to pull remote image content to the cluster
+      # Works around the issue of builder pods not having access to registry.redhat.io
+      oc import-image "${image_name}":"${VERSION}" --from "${import_image}" --confirm --reference-policy=local
     else
       echo "Uploading and importing image skipped."
     fi
   else
-    if [ -n "${import_image}" ] ; then
-      echo "Warning: Import image ${import_image} requested, but uploading image ${image_name} instead."
-    fi
-    ct_os_upload_image "${image_name}" "${image_tagged}"
+    ct_os_upload_image "${import_image:-$image_name}" "${image_tagged}"
 
     # upload also other images, that template might need (list of pairs in the format <image>|<tag>
     local image_tag_a
diff --git a/test/test-lib.sh b/test/test-lib.sh
index 674eafd..b959c34 100644
--- a/test/test-lib.sh
+++ b/test/test-lib.sh
@@ -254,7 +254,7 @@ function ct_npm_works() {
   local tmpdir
   tmpdir=$(mktemp -d)
   : "  Testing npm in the container image"
-  cid_file="${tmpdir}/cid"
+  local cid_file="${tmpdir}/cid"
   if ! docker run --rm "${IMAGE_NAME}" /bin/bash -c "npm --version" >"${tmpdir}/version" ; then
     echo "ERROR: 'npm --version' does not work inside the image ${IMAGE_NAME}." >&2
     return 1