diff --git a/py2-constraints.txt b/py2-constraints.txt
index 21861a327c..a49100da2b 100644
--- a/py2-constraints.txt
+++ b/py2-constraints.txt
@@ -74,4 +74,8 @@ gitdb2===2.0.6
 # Projects that are known to have had a final py2-supporting release
 bandit===1.6.2
 python-keystoneclient===3.22.0
+dnspython===1.16.0
+setuptools===44.1.1
+pycadf===2.10.0
+smmap===3.0.5
 PasteDeploy==2.1.1
diff --git a/tox.ini b/tox.ini
index c7a6f63779..f086bdbbce 100644
--- a/tox.ini
+++ b/tox.ini
@@ -2,6 +2,11 @@
 envlist = py37,py27,pep8
 minversion = 2.3.2
 skipsdist = True
+requires =
+  # required to support py27/py36 envs
+  virtualenv<20.22
+  # project-wide requirement; see .zuul.yaml
+  tox<4
 
 [testenv]
 usedevelop = True