diff --git a/ansible/roles/pip/defaults/main.yml b/ansible/roles/pip/defaults/main.yml
index 4377c819e880a3e1626ecfe320ccd13898b4b01a..eb3ec24d53d462a3e8ee8b04b4c1468085db2aa0 100644
--- a/ansible/roles/pip/defaults/main.yml
+++ b/ansible/roles/pip/defaults/main.yml
@@ -16,3 +16,5 @@ pip_index_url: ""
 # disabled
 pip_trusted_hosts: []
 
+# Optional: proxy configuration
+pip_proxy: ""
diff --git a/ansible/roles/pip/tasks/main.yml b/ansible/roles/pip/tasks/main.yml
index e85eb4b846a62f629bb5f3896694a9e318d5204a..3bf421d0a8074d86c65553a9fb0b77fd15d6d150 100644
--- a/ansible/roles/pip/tasks/main.yml
+++ b/ansible/roles/pip/tasks/main.yml
@@ -1,6 +1,6 @@
 ---
-- include_tasks: pip_local_mirror.yml
+- include_tasks: pip_conf.yml
   loop: "{{ pip_applicable_users }}"
   loop_control:
     loop_var: user
-  when: pip_local_mirror | bool
+  when: (pip_local_mirror | bool) or (pip_proxy | length > 0)
diff --git a/ansible/roles/pip/tasks/pip_local_mirror.yml b/ansible/roles/pip/tasks/pip_conf.yml
similarity index 89%
rename from ansible/roles/pip/tasks/pip_local_mirror.yml
rename to ansible/roles/pip/tasks/pip_conf.yml
index f11c700656efa56e0b4881e1d3597b797383e2fc..2fef94f694f80177f0b9926edb59ecc06792023f 100644
--- a/ansible/roles/pip/tasks/pip_local_mirror.yml
+++ b/ansible/roles/pip/tasks/pip_conf.yml
@@ -17,6 +17,9 @@
         {{ host }}
         {% endfor -%}
       {% endif -%}
+      {% if pip_proxy | length > 0 -%}
+      proxy = {{ pip_proxy }}
+      {% endif -%}
     dest: "~{{ user}}/.pip/pip.conf"
   become: True
   become_user: "{{ user }}"
diff --git a/doc/source/configuration/hosts.rst b/doc/source/configuration/hosts.rst
index d2b45dffd47b22e31c31ec765d84448b9016e203..38658c3c731b18edc8c509a05b98d0452d21f457 100644
--- a/doc/source/configuration/hosts.rst
+++ b/doc/source/configuration/hosts.rst
@@ -94,21 +94,27 @@ For example, to set the bootstrap user for controllers to ``centos``:
 
    controller_bootstrap_user: centos
 
-PyPI Mirror
-===========
+PyPI Mirror and proxy
+=====================
 *tags:*
   | ``pip``
 
-Kayobe supports configuration of a PyPI mirror, via variables in
-``${KAYOBE_CONFIG_PATH}/pip.yml``. This functionality is enabled by setting the
-``pip_local_mirror`` variable to ``true``.
+Kayobe supports configuration of a PyPI mirror and/or proxy, via variables in
+``${KAYOBE_CONFIG_PATH}/pip.yml``.
+Mirror functionality is enabled by setting the ``pip_local_mirror`` variable to
+``true`` and proxy functionality is enabled by setting ``pip_proxy`` variable
+to a proxy URL.
+
+Kayobe will generate configuration for:
 
-Kayobe will generate configuration for
-``pip`` and ``easy_install`` to use the mirror, for the list of users defined
-by ``pip_applicable_users`` (default ``kayobe_ansible_user`` and ``root``), in
-addition to the user used for Kolla Ansible (``kolla_ansible_user``). The
-mirror URL is configured via ``pip_index_url``, and ``pip_trusted_hosts`` is a
-list of 'trusted' hosts, for which SSL verification will be disabled.
+* ``pip`` to use the mirror and proxy
+* ``easy_install`` to use the mirror
+
+for the list of users defined by ``pip_applicable_users`` (default
+``kayobe_ansible_user`` and ``root``), in addition to the user used for Kolla
+Ansible (``kolla_ansible_user``). The mirror URL is configured via
+``pip_index_url``, and ``pip_trusted_hosts`` is a list of 'trusted' hosts, for
+which SSL verification will be disabled.
 
 For example, to configure use of the test PyPI mirror at
 https://test.pypi.org/simple/:
@@ -119,6 +125,14 @@ https://test.pypi.org/simple/:
    pip_local_mirror: true
    pip_index_url: https://test.pypi.org/simple/
 
+To configure use of the PyPI proxy:
+
+.. code-block:: yaml
+   :caption: ``pip.yml``
+
+   pip_proxy: http://your_proxy_server:3128
+
+
 Kayobe Remote Virtual Environment
 =================================
 *tags:*
diff --git a/etc/kayobe/pip.yml b/etc/kayobe/pip.yml
index e684bd8156b43dd90ba6ffeeaf9bc7ee5b5714aa..563c3ce08a8177544cfaaa8bc2966eefa90723fb 100644
--- a/etc/kayobe/pip.yml
+++ b/etc/kayobe/pip.yml
@@ -23,6 +23,9 @@
 # disabled
 #pip_trusted_hosts: []
 
+# PyPI proxy URL (format: http(s)://[user:password@]proxy_name:port)
+#pip_proxy: ""
+
 ###############################################################################
 # Dummy variable to allow Ansible to accept this file.
 workaround_ansible_issue_8743: yes
diff --git a/releasenotes/notes/pip_proxy-6c6022b6566dae69.yaml b/releasenotes/notes/pip_proxy-6c6022b6566dae69.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..301093f21fa872602938b58dda1e1802241e3858
--- /dev/null
+++ b/releasenotes/notes/pip_proxy-6c6022b6566dae69.yaml
@@ -0,0 +1,7 @@
+---
+features:
+  - |
+    Introduces a new option - ``pip_proxy`` - to configure Pip package
+    installation via a user-defined http(s) proxy. This is set on a per-user
+    basis, and by default this is for the same users as pip_local_mirror
+    feature.