diff --git a/python/scripts/mkvenv.py b/python/scripts/mkvenv.py
index a4534e41b5..3c48f8b9ba 100644
--- a/python/scripts/mkvenv.py
+++ b/python/scripts/mkvenv.py
@@ -34,6 +34,7 @@
 # later. See the COPYING file in the top-level directory.
 
 import argparse
+from importlib.util import find_spec
 import logging
 import os
 from pathlib import Path
@@ -76,6 +77,10 @@ class QemuEnvBuilder(venv.EnvBuilder):
 
     def __init__(self, *args: Any, **kwargs: Any) -> None:
         logger.debug("QemuEnvBuilder.__init__(...)")
+
+        if kwargs.get("with_pip", False):
+            check_ensurepip()
+
         super().__init__(*args, **kwargs)
 
         # Make the context available post-creation:
@@ -98,6 +103,38 @@ def get_value(self, field: str) -> str:
         return ret
 
 
+def check_ensurepip() -> None:
+    """
+    Check that we have ensurepip.
+
+    Raise a fatal exception with a helpful hint if it isn't available.
+    """
+    if not find_spec("ensurepip"):
+        msg = (
+            "Python's ensurepip module is not found.\n"
+            "It's normally part of the Python standard library, "
+            "maybe your distribution packages it separately?\n"
+            "Either install ensurepip, or alleviate the need for it in the "
+            "first place by installing pip and setuptools for "
+            f"'{sys.executable}'.\n"
+            "(Hint: Debian puts ensurepip in its python3-venv package.)"
+        )
+        raise Ouch(msg)
+
+    # ensurepip uses pyexpat, which can also go missing on us:
+    if not find_spec("pyexpat"):
+        msg = (
+            "Python's pyexpat module is not found.\n"
+            "It's normally part of the Python standard library, "
+            "maybe your distribution packages it separately?\n"
+            "Either install pyexpat, or alleviate the need for it in the "
+            "first place by installing pip and setuptools for "
+            f"'{sys.executable}'.\n\n"
+            "(Hint: NetBSD's pkgsrc debundles this to e.g. 'py310-expat'.)"
+        )
+        raise Ouch(msg)
+
+
 def make_venv(  # pylint: disable=too-many-arguments
     env_dir: Union[str, Path],
     system_site_packages: bool = False,