diff --git a/.evergreen/config.yml b/.evergreen/config.yml
index 3026cee766..56142e13af 100644
--- a/.evergreen/config.yml
+++ b/.evergreen/config.yml
@@ -426,6 +426,7 @@ functions:
           fi
 
           PYTHON_BINARY=${PYTHON_BINARY} \
+            PYTHON3_BINARY=${python3_binary} \
             GREEN_FRAMEWORK=${GREEN_FRAMEWORK} \
             C_EXTENSIONS=${C_EXTENSIONS} \
             COVERAGE=${COVERAGE} \
@@ -1695,6 +1696,7 @@ axes:
         run_on: rhel70-small
         batchtime: 10080  # 7 days
         variables:
+          python3_binary: "/opt/python/3.6/bin/python3"
           libmongocrypt_url: https://s3.amazonaws.com/mciuploads/libmongocrypt/rhel-70-64-bit/master/latest/libmongocrypt.tar.gz
       - id: suse12-x86-64-test
         display_name: "SUSE 12 (x86_64)"
diff --git a/.evergreen/run-tests.sh b/.evergreen/run-tests.sh
index e5172edf1c..e739b11c21 100755
--- a/.evergreen/run-tests.sh
+++ b/.evergreen/run-tests.sh
@@ -6,6 +6,7 @@ set -o errexit  # Exit the script with error if any of the commands fail
 #  AUTH               Set to enable authentication. Defaults to "noauth"
 #  SSL                Set to enable SSL. Defaults to "nossl"
 #  PYTHON_BINARY      The Python version to use. Defaults to whatever is available
+#  PYTHON3_BINARY     Path to a working Python 3.5+ binary.
 #  GREEN_FRAMEWORK    The green framework to test with, if any.
 #  C_EXTENSIONS       Pass --no_ext to setup.py, or not.
 #  COVERAGE           If non-empty, run the test suite with coverage.
@@ -22,6 +23,7 @@ fi
 AUTH=${AUTH:-noauth}
 SSL=${SSL:-nossl}
 PYTHON_BINARY=${PYTHON_BINARY:-}
+PYTHON3_BINARY=${PYTHON3_BINARY:-python3}
 GREEN_FRAMEWORK=${GREEN_FRAMEWORK:-}
 C_EXTENSIONS=${C_EXTENSIONS:-}
 COVERAGE=${COVERAGE:-}
@@ -167,11 +169,28 @@ if [ -n "$TEST_ENCRYPTION" ]; then
 
     # Start the mock KMS servers.
     if [ "$OS" != "Windows_NT" ]; then
+        # The mock KMS server requires Python 3.5 with boto3.
+        IS_PRE_35=$(python -c "import sys; sys.stdout.write('1' if sys.version_info < (3, 5) else '0')")
+        if [ $IS_PRE_35 = "1" ]; then
+            echo "PYTHON3_BINARY: $PYTHON3_BINARY"
+            deactivate
+            createvirtualenv $PYTHON3_BINARY venv-kms
+            python -m pip install boto3
+        fi
         pushd ${DRIVERS_TOOLS}/.evergreen/csfle
         python -u lib/kms_http_server.py --ca_file ../x509gen/ca.pem --cert_file ../x509gen/expired.pem --port 8000 &
         python -u lib/kms_http_server.py --ca_file ../x509gen/ca.pem --cert_file ../x509gen/wrong-host.pem --port 8001 &
         trap 'kill $(jobs -p)' EXIT HUP
         popd
+        # Restore the test virtualenv.
+        if [ $IS_PRE_35 = "1" ]; then
+            deactivate
+            if [ "Windows_NT" = "$OS" ]; then
+                . venv-encryption/Scripts/activate
+            else
+                . venv-encryption/bin/activate
+            fi
+        fi
     fi
 fi