diff --git a/.gitattributes b/.gitattributes
index b0200343e1..ba3c0b8e50 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -10,8 +10,8 @@
 /*.sh  recipes
 
 # vpython specs
-/.vpython*      recipes
-/gsutil.vpython recipes
+/.vpython*       recipes
+/gsutil.vpython3 recipes
 
 # Extensionless tools we want and support scripts.
 /autoninja*                   recipes
diff --git a/gsutil.py b/gsutil.py
index 61aaafe1f7..876ecac8d2 100755
--- a/gsutil.py
+++ b/gsutil.py
@@ -34,7 +34,7 @@ DEFAULT_BIN_DIR = os.path.join(THIS_DIR, 'external_bin', 'gsutil')
 
 IS_WINDOWS = os.name == 'nt'
 
-VERSION = '4.28'
+VERSION = '4.68'
 
 
 class InvalidGsutilError(Exception):
@@ -166,8 +166,8 @@ def run_gsutil(target, args, clean=False):
   assert sys.platform != 'cygwin'
 
   cmd = [
-      'vpython',
-      '-vpython-spec', os.path.join(THIS_DIR, 'gsutil.vpython'),
+      'vpython3',
+      '-vpython-spec', os.path.join(THIS_DIR, 'gsutil.vpython3'),
       '--',
       gsutil_bin
   ] + args_opt + args
diff --git a/gsutil.vpython b/gsutil.vpython
deleted file mode 100644
index c2e5ff7af4..0000000000
--- a/gsutil.vpython
+++ /dev/null
@@ -1,104 +0,0 @@
-# vpython VirtualEnv protobuf for "gsutil".
-#
-# See:
-# https://chromium.googlesource.com/infra/luci/luci-go/+/HEAD/vpython/api/vpython/spec.proto
-#
-# This is a "vpython" VirtualEnv specification applied to invocations of "gsutil"
-# by the bootstrap wrapper, "gsutil.py". It ensures that any Python distribution
-# has the expected Python packages installed.
-#
-# This is specifically relevant on Google Compute Engine invocations of
-# "gsutil", where a stock system-deployed file in "/etc/" explicitly specifies
-# that the "google_compute_engine" and "boto" Python packages are available.
-
-python_version: "2.7"
-
-wheel <
-  name: "infra/python/wheels/google_compute_engine-py2_py3"
-  version: "version:2.6.2"
->
-wheel <
-  name: "infra/python/wheels/boto-py2_py3"
-  version: "version:2.48.0"
->
-
-# "gsutil" on non-GCE can require PyOpenSSL, which, in turn, requires
-# "cryptography".
-
-wheel: <
-  name: "infra/python/wheels/pyopenssl-py2_py3"
-  version: "version:17.2.0"
->
-
-##
-# BEGIN "cryptography" dependencies.
-##
-
-wheel: <
-  name: "infra/python/wheels/cryptography/${vpython_platform}"
-  version: "version:2.9.2.chromium.1"
->
-
-wheel: <
-  name: "infra/python/wheels/appdirs-py2_py3"
-  version: "version:1.4.3"
->
-
-wheel: <
-  name: "infra/python/wheels/enum34-py2"
-  version: "version:1.1.6"
->
-
-wheel: <
-  name: "infra/python/wheels/cffi/${vpython_platform}"
-  version: "version:1.14.5.chromium.7"
->
-
-wheel: <
-  name: "infra/python/wheels/idna-py2_py3"
-  version: "version:2.5"
->
-
-wheel: <
-  name: "infra/python/wheels/ipaddress-py2"
-  version: "version:1.0.18"
->
-
-wheel: <
-  name: "infra/python/wheels/packaging-py2_py3"
-  version: "version:16.8"
->
-
-wheel: <
-  name: "infra/python/wheels/pyasn1-py2_py3"
-  version: "version:0.2.3"
->
-
-wheel: <
-  name: "infra/python/wheels/pycparser-py2_py3"
-  version: "version:2.17"
->
-
-wheel: <
-  name: "infra/python/wheels/pyparsing-py2_py3"
-  version: "version:2.2.0"
->
-
-wheel: <
-  name: "infra/python/wheels/setuptools-py2_py3"
-  version: "version:34.3.2"
->
-
-wheel: <
-  name: "infra/python/wheels/six-py2_py3"
-  version: "version:1.10.0"
->
-
-##
-# END "cryptography" dependencies.
-##
-
-wheel: <
-  name: "infra/python/wheels/crcmod/${vpython_platform}"
-  version: "version:1.7.chromium.3"
->
diff --git a/gsutil.vpython3 b/gsutil.vpython3
new file mode 100644
index 0000000000..a0e0a89e4b
--- /dev/null
+++ b/gsutil.vpython3
@@ -0,0 +1,19 @@
+# vpython VirtualEnv protobuf for "gsutil".
+#
+# See:
+# https://chromium.googlesource.com/infra/luci/luci-go/+/HEAD/vpython/api/vpython/spec.proto
+#
+# This is a "vpython" VirtualEnv specification applied to invocations of "gsutil"
+# by the bootstrap wrapper, "gsutil.py". It ensures that any Python distribution
+# has the expected Python packages installed.
+#
+# This is specifically relevant on Google Compute Engine invocations of
+# "gsutil", where a stock system-deployed file in "/etc/" explicitly specifies
+# that the "google_compute_engine" and "boto" Python packages are available.
+
+python_version: "3.8"
+
+wheel: <
+  name: "infra/python/wheels/crcmod/${vpython_platform}"
+  version: "version:1.7.chromium.3"
+>