diff --git a/freeipa.spec.in b/freeipa.spec.in
index 3bc145cd9..879781db2 100644
--- a/freeipa.spec.in
+++ b/freeipa.spec.in
@@ -876,16 +876,54 @@ find \
 # TODO: workaround: some scripts are copied over, so the are always py2.
 # We have to explicitly set python3 here for ported files here
 PY3_SUBST_PATHS='
+client/ipa-certupdate
+client/ipa-client-automount
+client/ipa-client-install
+daemons/dnssec/ipa-dnskeysync-replica
+daemons/dnssec/ipa-dnskeysyncd
+daemons/dnssec/ipa-ods-exporter
+daemons/ipa-otpd/test.py
+install/certmonger/ipa-server-guard
+install/certmonger/dogtag-ipa-ca-renew-agent-submit
+install/oddjob/com.redhat.idm.trust-fetch-domains
+install/restart_scripts/renew_ra_cert_pre
+install/restart_scripts/renew_ca_cert
+install/restart_scripts/renew_ra_cert
+install/restart_scripts/restart_httpd
+install/restart_scripts/renew_kdc_cert
+install/restart_scripts/stop_pkicad
+install/restart_scripts/restart_dirsrv
+install/tools/ipa-advise
+install/tools/ipa-adtrust-install
 install/tools/ipa-backup
+install/tools/ipa-ca-install
+install/tools/ipa-cacert-manage
 install/tools/ipa-compat-manage
+install/tools/ipa-csreplica-manage
+install/tools/ipa-custodia
 install/tools/ipa-dns-install
+install/tools/ipa-httpd-kdcproxy
+install/tools/ipa-kra-install
+install/tools/ipa-ldap-updater
 install/tools/ipa-managed-entries
 install/tools/ipa-nis-manage
+install/tools/ipa-otptoken-import
+install/tools/ipa-pkinit-manage
+install/tools/ipa-pki-retrieve-key
+install/tools/ipa-replica-conncheck
+install/tools/ipa-replica-install
+install/tools/ipa-replica-manage
 install/tools/ipa-replica-prepare
+install/tools/ipa-restore
+install/tools/ipa-server-certinstall
+install/tools/ipa-server-install
+install/tools/ipa-server-upgrade
+install/tools/ipa-winsync-migrate
 install/tools/ipactl
+ipa
 '
 for P in $PY3_SUBST_PATHS; do
-    sed -i -e '1 s|^#!.*\bpython[^ ]*|#!%{__python3}|' $P
+    sed -i -e '1 s|^#!.*\bpython[0-9]*\(\s\+-\)\?|#!%{__python3} -bb|' $P
 done;
 
 %endif # with_python3