diff --git a/NEWS.rst b/NEWS.rst
index a3b05ed834f57d1cbde3c3d2ee6d9964351a43df..2ae1fc508f420574e8a89dabcef9953f50539fb3 100644
--- a/NEWS.rst
+++ b/NEWS.rst
@@ -8,6 +8,14 @@
 .. towncrier release notes start
 
 
+9.0.3 (2018-03-21)
+==================
+
+- Fix an error where the vendored requests was not correctly containing itself
+  to only the internal vendored prefix.
+- Restore compatability with 2.6.
+
+
 9.0.2 (2018-03-16)
 ==================
 
diff --git a/src/pip/_vendor/requests/packages.py b/src/pip/_vendor/requests/packages.py
index 6336a07d9d71e49314249686d91f78dea4485d2a..9582fa730f121634348a79c1a8b0cc2df99c616f 100644
--- a/src/pip/_vendor/requests/packages.py
+++ b/src/pip/_vendor/requests/packages.py
@@ -4,11 +4,13 @@ import sys
 # I don't like it either. Just look the other way. :)
 
 for package in ('urllib3', 'idna', 'chardet'):
-    locals()[package] = __import__("pip._vendor." + package)
+    vendored_package = "pip._vendor." + package
+    locals()[package] = __import__(vendored_package)
     # This traversal is apparently necessary such that the identities are
     # preserved (requests.packages.urllib3.* is urllib3.*)
     for mod in list(sys.modules):
-        if mod == package or mod.startswith(package + '.'):
-            sys.modules['requests.packages.' + mod] = sys.modules[mod]
+        if mod == vendored_package or mod.startswith(vendored_package + '.'):
+            unprefixed_mod = mod[len("pip._vendor."):]
+            sys.modules['pip._vendor.requests.packages.' + unprefixed_mod] = sys.modules[mod]
 
 # Kinda cool, though, right?
diff --git a/tasks/vendoring/patches/requests.patch b/tasks/vendoring/patches/requests.patch
index b4aa10a37b47b0abd5fa2b3c9f6ed68811b3b3b4..e09171c5007c1b8c83e96bfc7df0a667a4704e40 100644
--- a/tasks/vendoring/patches/requests.patch
+++ b/tasks/vendoring/patches/requests.patch
@@ -1,16 +1,24 @@
 diff --git a/src/pip/_vendor/requests/packages.py b/src/pip/_vendor/requests/packages.py
-index 7232fe0f..6336a07d 100644
+index 6336a07d..9582fa73 100644
 --- a/src/pip/_vendor/requests/packages.py
 +++ b/src/pip/_vendor/requests/packages.py
-@@ -4,7 +4,7 @@ import sys
+@@ -4,11 +4,13 @@ import sys
  # I don't like it either. Just look the other way. :)
 
  for package in ('urllib3', 'idna', 'chardet'):
 -    locals()[package] = __import__(package)
-+    locals()[package] = __import__("pip._vendor." + package)
++    vendored_package = "pip._vendor." + package
++    locals()[package] = __import__(vendored_package)
      # This traversal is apparently necessary such that the identities are
      # preserved (requests.packages.urllib3.* is urllib3.*)
      for mod in list(sys.modules):
+-        if mod == package or mod.startswith(package + '.'):
+-            sys.modules['requests.packages.' + mod] = sys.modules[mod]
++        if mod == vendored_package or mod.startswith(vendored_package + '.'):
++            unprefixed_mod = mod[len("pip._vendor."):]
++            sys.modules['pip._vendor.requests.packages.' + unprefixed_mod] = sys.modules[mod]
+
+ # Kinda cool, though, right?
 
 diff --git a/src/pip/_vendor/requests/__init__.py b/src/pip/_vendor/requests/__init__.py
 index 9c3b769..44f6836 100644