diff --git a/.zuul.yaml b/.zuul.yaml
index 09fe909001..0491d92a37 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -528,6 +528,8 @@
       python_version: 2.7
       tox_environment:
         TMPDIR: '{{ ansible_env.HOME }}/xfstmp'
+      # This seems defensible for a l-c job
+      ensure_tox_version: '<4'
 
 # Image building jobs
 - secret:
diff --git a/py2-constraints.txt b/py2-constraints.txt
index a4209fbfc6..27c4a0022c 100644
--- a/py2-constraints.txt
+++ b/py2-constraints.txt
@@ -78,3 +78,4 @@ smmap===3.0.5
 PasteDeploy==2.1.1
 pytest==4.6.11
 pytest-cov==2.12.1
+attrs==21.4.0
diff --git a/tools/playbooks/common/install_dependencies.yaml b/tools/playbooks/common/install_dependencies.yaml
index 40eecd0377..808487fe78 100644
--- a/tools/playbooks/common/install_dependencies.yaml
+++ b/tools/playbooks/common/install_dependencies.yaml
@@ -39,8 +39,10 @@
         # trying to install a too-new mock or attrs??
         - 'mock<4'
         - 'attrs<22.1.0'
+        # crudini pulls in iniparse which can conflict with distro-installed
+        # packages on centos7
+        - 'crudini<0.9.4'
         # Order matters; install constrained versions *first*, then unconstrained
-        - crudini
         - eventlet
         - pyeclib
         - pytest
diff --git a/tox.ini b/tox.ini
index e1a6074af3..6ce934b766 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,7 +1,6 @@
 [tox]
 envlist = py37,py27,pep8
-minversion = 2.3.2
-skipsdist = True
+minversion = 3.18.0
 
 [pytest]
 addopts = --verbose --cov=swift --cov-branch --cov-report=html:cover --cov-report term
@@ -21,14 +20,18 @@ commands =
 allowlist_externals =
   bash
   find
-passenv = SWIFT_* *_proxy
+passenv = SWIFT_*
 
 [testenv:s3api]
 usedevelop = False
 deps = {[testenv:py36]deps}
 commands =
   pytest {posargs:test/s3api}
-passenv = SWIFT_* *_proxy
+passenv = SWIFT_*
+# For some reason we hit some EPERM issue when building the package for these tests?
+# (CentOS 8, CPython 3.6, tox 3.28.0)
+skipsdist = True
+skip_install = True
 
 [testenv:py27]
 deps =
@@ -49,6 +52,8 @@ deps = {[testenv:py36]deps}
 setenv = VIRTUAL_ENV={envdir}
 
 [testenv:pep8]
+allowlist_externals =
+  ./.manpages
 commands =
   flake8 {posargs:swift test doc setup.py}
   flake8 --filename=bin/swift* bin
@@ -59,11 +64,15 @@ commands =
 [testenv:func-py3]
 basepython = python3
 deps = {[testenv:py36]deps}
+allowlist_externals =
+  ./.functests
 commands = ./.functests {posargs}
 
 [testenv:func-ec-py3]
 basepython = python3
 deps = {[testenv:py36]deps}
+allowlist_externals =
+  ./.functests
 commands = ./.functests {posargs}
 setenv = SWIFT_TEST_IN_PROCESS=1
          SWIFT_TEST_IN_PROCESS_CONF_LOADER=ec
@@ -71,6 +80,8 @@ setenv = SWIFT_TEST_IN_PROCESS=1
 [testenv:func-encryption-py3]
 basepython = python3
 deps = {[testenv:py36]deps}
+allowlist_externals =
+  ./.functests
 commands = ./.functests {posargs}
 setenv = SWIFT_TEST_IN_PROCESS=1
          SWIFT_TEST_IN_PROCESS_CONF_LOADER=encryption
@@ -78,11 +89,15 @@ setenv = SWIFT_TEST_IN_PROCESS=1
 [testenv:func]
 basepython = python2.7
 deps = {[testenv:py27]deps}
+allowlist_externals =
+  ./.functests
 commands = ./.functests {posargs}
 
 [testenv:func-encryption]
 basepython = python2.7
 deps = {[testenv:py27]deps}
+allowlist_externals =
+  ./.functests
 commands = ./.functests {posargs}
 setenv = SWIFT_TEST_IN_PROCESS=1
          SWIFT_TEST_IN_PROCESS_CONF_LOADER=encryption
@@ -90,6 +105,8 @@ setenv = SWIFT_TEST_IN_PROCESS=1
 [testenv:func-ec]
 basepython = python2.7
 deps = {[testenv:py27]deps}
+allowlist_externals =
+  ./.functests
 commands = ./.functests {posargs}
 setenv = SWIFT_TEST_IN_PROCESS=1
          SWIFT_TEST_IN_PROCESS_CONF_LOADER=ec
@@ -166,6 +183,9 @@ deps =
   -c{toxinidir}/lower-constraints.txt
   -r{toxinidir}/test-requirements.txt
   -r{toxinidir}/requirements.txt
+# Drop the --upgrade flag so we don't accidentally drag anything forward when
+# we install swift
+install_command = pip install {opts} {packages}
 
 [testenv:pdf-docs]
 basepython = python3