diff --git a/tox.ini b/tox.ini
index a0ef4070d0..402cea9053 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,16 +1,16 @@
 [tox]
 minversion = 3.2.0
-skipsdist = True
 envlist = py37,pep8,api-ref,docs,genconfig,genpolicy,releasenotes,protection
+ignore_basepython_conflict = true
 
 [testenv]
 usedevelop = True
 basepython = python3
 setenv = VIRTUAL_ENV={envdir}
-deps = -c{env:UPPER_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
-       -r{toxinidir}/test-requirements.txt
-       -r{toxinidir}/requirements.txt
-       .[ldap,memcache,mongodb]
+deps =
+  -c{env:UPPER_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
+  -r{toxinidir}/test-requirements.txt
+  .[ldap,memcache,mongodb]
 commands =
   find keystone -type f -name "*.pyc" -delete
   stestr run {posargs}
@@ -19,16 +19,10 @@ whitelist_externals =
   find
 passenv = http_proxy HTTP_PROXY https_proxy HTTPS_PROXY no_proxy NO_PROXY PBR_VERSION
 
-[testenv:api-ref]
-deps = -r{toxinidir}/doc/requirements.txt
-commands =
-  bash -c "rm -rf api-ref/build"
-  sphinx-build -W -b html -d api-ref/build/doctrees api-ref/source api-ref/build/html
-
 [testenv:pep8]
 deps =
-     .[bandit]
-     {[testenv]deps}
+  .[bandit]
+  {[testenv]deps}
 commands =
   flake8 --ignore=D100,D101,D102,D103,D104,E305,E402,W503,W504,W605
   # Run bash8 during pep8 runs to ensure violations are caught by
@@ -39,6 +33,7 @@ commands =
 
 [testenv:fast8]
 envdir = {toxworkdir}/pep8
+deps = {[testenv:pep8]deps}
 commands =
   {toxinidir}/tools/fast8.sh
 passenv = FAST8_NUM_COMMITS
@@ -46,9 +41,10 @@ passenv = FAST8_NUM_COMMITS
 [testenv:bandit]
 # NOTE(browne): This is required for the integration test job of the bandit
 # project. Please do not remove.
-deps = -c{env:UPPER_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
-       -r{toxinidir}/requirements.txt
-       .[bandit]
+deps =
+  -c{env:UPPER_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
+  -r{toxinidir}/requirements.txt
+  .[bandit]
 commands = bandit -r keystone -x 'keystone/tests/*'
 
 [testenv:cover]
@@ -87,7 +83,9 @@ passenv =
     KSTEST_PROJECT_ID
 
 [testenv:functional]
-deps = -r{toxinidir}/test-requirements.txt
+deps =
+  -c{env:UPPER_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
+  -r{toxinidir}/test-requirements.txt
 setenv = OS_TEST_PATH=./keystone/tests/functional
 commands =
   find keystone -type f -name "*.pyc" -delete
@@ -108,7 +106,6 @@ passenv =
 filename= *.py,keystone-manage
 show-source = true
 enable-extensions = H203,H904
-
 # D100: Missing docstring in public module
 # D101: Missing docstring in public class
 # D102: Missing docstring in public method
@@ -120,7 +117,6 @@ enable-extensions = H203,H904
 # W503: line break before binary operator
 # W504 line break after binary operator
 ignore = D100,D101,D102,D103,D104,D203,E402,W503,W504
-
 exclude=.venv,.git,.tox,build,dist,*lib/python*,*egg,tools,vendor,.update-venv,*.ini,*.po,*.pot
 max-complexity=24
 
@@ -154,9 +150,17 @@ commands =
   make -C doc/build/pdf
 
 [testenv:releasenotes]
-deps = -r{toxinidir}/doc/requirements.txt
+envdir = {toxworkdir}/docs
+deps = {[testenv:docs]deps}
 commands = sphinx-build -a -E -W -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html
 
+[testenv:api-ref]
+envdir = {toxworkdir}/docs
+deps = {[testenv:docs]deps}
+commands =
+  bash -c "rm -rf api-ref/build"
+  sphinx-build -W -b html -d api-ref/build/doctrees api-ref/source api-ref/build/html
+
 [testenv:genconfig]
 commands = oslo-config-generator --config-file=config-generator/keystone.conf