diff --git a/elastic_recheck/bot.py b/elastic_recheck/bot.py
index 16b34568..c67a0c89 100755
--- a/elastic_recheck/bot.py
+++ b/elastic_recheck/bot.py
@@ -15,8 +15,9 @@
 #    under the License.
 
 
-# The configuration file should look like:
 """
+The configuration file should look like:
+```
 [ircbot]
 nick=NICKNAME
 pass=PASSWORD
@@ -31,16 +32,16 @@ user=gerrit2
 [data_source[
 es_url=URLofELASTICSEARCH
 db_uri=SQLALCHEMY_URI_TO_SUBUNIT2SQL
-"""
+```
 
 # The yaml channel config should look like:
-"""
+```
 openstack-qa:
     events:
      - positive
      - negative
+```
 """
-
 import argparse
 import daemon
 import os
diff --git a/elastic_recheck/config.py b/elastic_recheck/config.py
index 7af3fba0..a81a4f24 100644
--- a/elastic_recheck/config.py
+++ b/elastic_recheck/config.py
@@ -12,9 +12,9 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-from six.moves import configparser
 import os
 import re
+from six.moves import configparser
 
 DEFAULT_INDEX_FORMAT = 'logstash-%Y.%m.%d'
 
@@ -52,9 +52,9 @@ INCLUDED_PROJECTS_REGEX = "(^openstack/|devstack|grenade)"
 # Let's value legibility over pep8 line width here...
 ALL_FAILS_QUERY = (
     '('
-    '(filename:"job-output.txt" AND message:"POST-RUN END" AND message:"playbooks/base/post.yaml")'  # flake8: noqa
+    '(filename:"job-output.txt" AND message:"POST-RUN END" AND message:"playbooks/base/post.yaml")'  # noqa E501
     ' OR '
-    '(filename:"console.html" AND (message:"[Zuul] Job complete" OR message:"[SCP] Copying console log" OR message:"Grabbing consoleLog"))'  # flake8: noqa
+    '(filename:"console.html" AND (message:"[Zuul] Job complete" OR message:"[SCP] Copying console log" OR message:"Grabbing consoleLog"))'  # noqa E501
     ')'
     ' AND build_status:"FAILURE"'
     ' AND build_queue:"gate"'
@@ -130,7 +130,8 @@ class Config(object):
             if config.has_section('gerrit'):
                 self.gerrit_user = config.get('gerrit', 'user')
                 self.gerrit_query_file = config.get('gerrit', 'query_file')
-                # workaround for python api change https://docs.python.org/3/library/configparser.html#fallback-values
+                # workaround for python api change:
+                # https://docs.python.org/3/library/configparser.html#fallback-values
                 try:
                     self.gerrit_host = config.get('gerrit',
                                                   'host',
diff --git a/elastic_recheck/elasticRecheck.py b/elastic_recheck/elasticRecheck.py
index b2c043b6..adbb9e85 100644
--- a/elastic_recheck/elasticRecheck.py
+++ b/elastic_recheck/elasticRecheck.py
@@ -227,7 +227,7 @@ class Stream(object):
             # these items. It's orthoginal to non voting ES searching.
             if " (non-voting)" in line:
                 continue
-            m = re.search("- ([\w-]+)\s*(http://\S+)\s*:\s*FAILURE", line)
+            m = re.search(r"- ([\w-]+)\s*(http://\S+)\s*:\s*FAILURE", line)
             if m:
                 failed_tests.append(FailJob(m.group(1), m.group(2)))
         return failed_tests
diff --git a/elastic_recheck/query_builder.py b/elastic_recheck/query_builder.py
index e1976f9b..272f132a 100644
--- a/elastic_recheck/query_builder.py
+++ b/elastic_recheck/query_builder.py
@@ -78,9 +78,9 @@ def result_ready(change, patchset, name, short_uuid):
     # TODO(dmsimard): Revisit this query once Zuul v2 is no longer supported
     # Let's value legibility over pep8 line width here...
     query = (
-        '((filename:"job-output.txt" AND message:"POST-RUN END" AND message:"project-config/playbooks/base/post-ssh.yaml")'  # flake8: noqa
+        '((filename:"job-output.txt" AND message:"POST-RUN END" AND message:"project-config/playbooks/base/post-ssh.yaml")'  # noqa E501
         ' OR '
-        '(filename:"console.html" AND (message:"[Zuul] Job complete" OR message:"[SCP] Copying console log" OR message:"Grabbing consoleLog")))'  # flake8: noqa
+        '(filename:"console.html" AND (message:"[Zuul] Job complete" OR message:"[SCP] Copying console log" OR message:"Grabbing consoleLog")))'  # noqa E501
         ' AND build_status:"FAILURE"'
         ' AND build_change:"{change}"'
         ' AND build_patchset:"{patchset}"'
diff --git a/setup.cfg b/setup.cfg
index a2f0c6c2..c9fbd93b 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -50,3 +50,16 @@ input_file = elastic_recheck/locale/elastic-recheck.pot
 keywords = _ gettext ngettext l_ lazy_gettext
 mapping_file = babel.cfg
 output_file = elastic_recheck/locale/elastic-recheck.pot
+
+[flake8]
+ignore =
+    # These are ignored intentionally in infra projects;
+    # please don't submit patches that solely correct them or enable them.
+    E124,E125,E129,E252,E402,E741,H,W503,W504
+    # TODO(ssbarnea): Remove temporary added ignores during flake8 upgrade:
+    E123  # E123 closing bracket does not match indentation of opening bracket's line
+    F632  # F632 use ==/!= to compare constant literals (str, bytes, int, float, tuple)
+    N802  # N802 function name {} should be lowercase
+    N806  # N806 variable '{}' in function should be lowercase
+    N813  # N813 camelcase '{}' imported as lowercase '{}'
+exclude=.venv,.git,.tox,dist,doc,*openstack/common*,*lib/python*,*egg,build
diff --git a/test-requirements.txt b/test-requirements.txt
index f69ad64b..ccd7df74 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -1,4 +1,4 @@
-hacking>=0.12.0,!=0.13.0,<0.14
+hacking>=3.1.0,<3.2.0; python_version>='3.5'
 coverage>=3.6
 fixtures>=3.0.0
 python-subunit
diff --git a/tools/unaccounted_rechecks.py b/tools/unaccounted_rechecks.py
index d2c74400..872cadf9 100755
--- a/tools/unaccounted_rechecks.py
+++ b/tools/unaccounted_rechecks.py
@@ -74,7 +74,7 @@ def collect_rechecks(gerrit, days="14"):
                         # bail early if the comment is outside the ER window
                         continue
 
-                    m = re.search('recheck (no bug|bug (\#)?(?P<bugno>\d+))$',
+                    m = re.search(r'recheck (no bug|bug (\#)?(?P<bugno>\d+))$',
                                   comment['message'])
                     if m:
                         dev = None
@@ -130,5 +130,6 @@ def main():
     changes = cross_ref_with_er(changes, opts.dir)
     summarize_changes(changes)
 
+
 if __name__ == "__main__":
     main()
diff --git a/tox.ini b/tox.ini
index 96c7f164..97ddf047 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,6 +1,6 @@
 [tox]
 minversion = 1.6
-envlist = pep8,py37,py36,py27,queries,docs
+envlist = linters,py38,py37,py36,py27,queries,docs
 skipsdist = True
 
 [testenv]
@@ -20,10 +20,6 @@ commands = python setup.py testr --slowest --testr-args='{posargs} tests.functio
 basepython = python3
 commands = python setup.py testr --slowest --testr-args='{posargs} tests.functional.test_queries'
 
-[testenv:pep8]
-basepython = python3
-commands = flake8
-
 [testenv:venv]
 basepython = python3
 commands = {posargs}
@@ -37,13 +33,6 @@ basepython = python3
 # test to run the bot as a non voting foreground process
 commands = elastic-recheck -f -n --noirc elasticRecheck.conf
 
-[flake8]
-# E125 Skipped because it's an overreach (and anti-emacs)
-# E123 Skipped because it decreases clarity in many cases
-
-ignore = E123,E125
-exclude=.venv,.git,.tox,dist,doc,*openstack/common*,*lib/python*,*egg,build
-
 [testenv:docs]
 basepython = python3
 deps = -r{toxinidir}/doc/requirements.txt
@@ -57,3 +46,13 @@ basepython = python3
 # separately, outside of the requirements files.
 deps = bindep
 commands = bindep test
+
+[testenv:linters]
+basepython = python3
+commands = flake8
+
+# deprecated, use linters instead
+[testenv:pep8]
+basepython = python3
+envdir = {toxworkdir}/linters
+commands =  {[testenv:linters]commands}
diff --git a/web_server.py b/web_server.py
index 6036131a..1cc68d5e 100755
--- a/web_server.py
+++ b/web_server.py
@@ -97,6 +97,7 @@ def main():
     while True:
         httpd.handle_request()
 
+
 if __name__ == '__main__':
     try:
         main()