diff --git a/test-requirements.txt b/test-requirements.txt
index 34b5381..bfff771 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -1,7 +1,6 @@
 # The order of packages is significant, because pip processes them in the order
 # of appearance. Changing the order has an impact on the overall integration
 # process, which may cause wedges in the gate later.
-hacking>=3.0.1,<3.1.0 # Apache-2.0
 
 coverage!=4.4,>=4.0 # Apache-2.0
 fixtures>=3.0.0 # Apache-2.0/BSD
@@ -11,5 +10,3 @@ stestr>=1.0.0 # Apache-2.0
 testrepository>=0.0.18 # Apache-2.0/BSD
 testtools>=2.2.0 # MIT
 osprofiler>=1.4.0 # Apache-2.0
-bandit>=1.1.0 # Apache-2.0
-flake8-import-order>=0.17.1 # LGPLv3
diff --git a/tox.ini b/tox.ini
index b26abea..c185502 100644
--- a/tox.ini
+++ b/tox.ini
@@ -28,6 +28,9 @@ commands =
 whitelist_externals = stestr
 
 [testenv:pep8]
+deps =
+  hacking>=3.0.1,<3.1.0 # Apache-2.0
+  flake8-import-order>=0.17.1 # LGPLv3
 commands = flake8
 
 [testenv:venv]