diff --git a/doc/requirements.txt b/doc/requirements.txt
index 7488c4b07b..94f9fa042c 100644
--- a/doc/requirements.txt
+++ b/doc/requirements.txt
@@ -4,7 +4,8 @@
 
 openstackdocstheme>=1.18.1 # Apache-2.0
 os-api-ref>=1.4.0 # Apache-2.0
-sphinx!=1.6.6,!=1.6.7,>=1.6.2 # BSD
+sphinx!=1.6.6,!=1.6.7,>=1.6.2;python_version>='3.4' # BSD
+sphinx!=1.6.6,!=1.6.7,>=1.6.2,<2.0.0;python_version=='2.7' # BSD
 reno>=2.5.0 # Apache-2.0
 sphinxcontrib-apidoc>=0.2.0 # BSD
 sphinxcontrib-httpdomain>=1.3.0 # BSD
diff --git a/test-requirements.txt b/test-requirements.txt
index 0361cdb8bc..d7bd8f6f8a 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -4,7 +4,7 @@
 
 # Hacking already pins down pep8, pyflakes and flake8
 hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0
-bandit>=1.1.0 # Apache-2.0
+bandit!=1.6.0,>=1.1.0 # Apache-2.0
 coverage!=4.4,>=4.0 # Apache-2.0
 fixtures>=3.0.0 # Apache-2.0/BSD
 kombu!=4.0.2,>=4.0.0 # BSD