diff --git a/test-requirements.txt b/test-requirements.txt
index 0375f1c..3765a25 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -1,4 +1,5 @@
+hacking
 bashate >= 0.2
+bandit;python_version>="3.5"
 PyYAML >= 3.1.0
-yamllint >= 0.5.2
-bandit!=1.6.0,>=1.1.0,<2.0.0
+yamllint<1.26.1;python_version>="3.0" # GPLv2
diff --git a/tox.ini b/tox.ini
index c7a9331..3833780 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,10 +1,13 @@
 [tox]
-envlist = linters
+envlist = linters, pep8
 minversion = 2.3
 skipsdist = True
 
 [testenv]
-install_command = pip install -U {opts} {packages}
+install_command = pip install \
+    -c{env:UPPER_CONSTRAINTS_FILE:https://opendev.org/openstack/requirements/raw/branch/stable/stein/upper-constraints.txt} \
+    {opts} {packages}
+
 setenv = VIRTUAL_ENV={envdir}
          OS_STDOUT_CAPTURE=1
          OS_STDERR_CAPTURE=1
@@ -36,9 +39,6 @@ ignore=H102
 basepython = python3
 usedevelop = False
 skip_install = True
-# hacking pins the version of flake8
-deps =
-    hacking!=0.13.0,<0.14,>=0.12.0 
 commands =
     flake8
 
@@ -74,5 +74,4 @@ commands = reno new {posargs}
 [testenv:bandit]
 basepython = python3
 description = Bandit code scan for *.py files under config folder
-deps = -r{toxinidir}/test-requirements.txt
 commands = bandit -r {toxinidir}/ -x '**/.tox/**',**/.eggs/** -lll