diff --git a/swift3/test/functional/setup_keystone b/swift3/test/functional/setup_keystone
index abc4390a..4a75d7f2 100644
--- a/swift3/test/functional/setup_keystone
+++ b/swift3/test/functional/setup_keystone
@@ -83,7 +83,6 @@ _setup_keystone()
 
     keystone-manage --config-file conf/keystone.conf --debug fernet_setup
     keystone-manage --config-file conf/keystone.conf --debug db_sync
-    keystone-manage --config-file conf/keystone.conf --debug pki_setup
     keystone-manage --config-file conf/keystone.conf --debug bootstrap \
         --bootstrap-password=$OS_PASSWORD \
         --bootstrap-admin-url=$OS_AUTH_URL \
diff --git a/tools/tox_install.sh b/tools/tox_install.sh
deleted file mode 100755
index 6c90cd72..00000000
--- a/tools/tox_install.sh
+++ /dev/null
@@ -1,38 +0,0 @@
-#!/usr/bin/env bash
-
-# Client constraint file contains this client version pin that is in conflict
-# with installing the client from source. We should remove the version pin in
-# the constraints file before applying it for from-source installation.
-
-set -e
-
-if [[ -z "$CONSTRAINTS_FILE" ]]; then
-    echo 'WARNING: expected $CONSTRAINTS_FILE to be set' >&2
-    PIP_FLAGS=(-U)
-else
-    # NOTE(tonyb): Place this in the tox enviroment's log dir so it will get
-    # published to logs.openstack.org for easy debugging.
-    localfile="$VIRTUAL_ENV/log/upper-constraints.txt"
-
-    if [[ "$CONSTRAINTS_FILE" != http* ]]; then
-        CONSTRAINTS_FILE="file://$CONSTRAINTS_FILE"
-    fi
-    curl "$CONSTRAINTS_FILE" --insecure --progress-bar --output "$localfile"
-
-    pip install -c"$localfile" openstack-requirements
-
-    # This is the main purpose of the script: Allow local installation of
-    # the current repo. It is listed in constraints file and thus any
-    # install will be constrained and we need to unconstrain it.
-    edit-constraints "$localfile" -- "$CLIENT_NAME"
-
-    # Also unconstrain eventlet, as our s3tests results rely on a more-recent
-    # version
-    edit-constraints "$localfile" -- eventlet
-    # Swift also hard-depends on a more-recent pyeclib
-    edit-constraints "$localfile" -- pyeclib
-
-    PIP_FLAGS=(-c"$localfile" -U)
-fi
-
-pip install "${PIP_FLAGS[@]}" "$@"
diff --git a/tox.ini b/tox.ini
index 057449d7..31f4350e 100644
--- a/tox.ini
+++ b/tox.ini
@@ -6,7 +6,7 @@ skipsdist = True
 [testenv]
 whitelist_externals =/bin/bash
 usedevelop = True
-install_command = {toxinidir}/tools/tox_install.sh {opts} {packages}
+install_command = pip install -c{env:UPPER_CONSTRAINTS_FILE:https://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt?h=stable/pike} -U {opts} {packages}
 # swift stable/pike (about 2.15.1) from openstack.org
 deps =
   -r{toxinidir}/test-requirements.txt
@@ -21,7 +21,6 @@ setenv = VIRTUAL_ENV={envdir}
          NOSE_OPENSTACK_STDOUT=1
          NOSE_WITH_COVERAGE=1
          NOSE_COVER_BRANCHES=1
-         CONSTRAINTS_FILE=https://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt?h=stable/newton
          LOG_DEST={envdir}/log
 
 [testenv:tempauth]
@@ -33,10 +32,10 @@ setenv = {[testenv]setenv}
 commands = /bin/bash {posargs:swift3/test/functional/run_test.sh}
 setenv = {[testenv]setenv}
          AUTH=keystone
-# keystone 9.0.0 from github
+# keystone 12.0.0 (pike) from openstack.org
 deps =
   {[testenv]deps}
-  http://tarballs.openstack.org/keystone/keystone-9.0.0.tar.gz
+  http://tarballs.openstack.org/keystone/keystone-12.0.0.tar.gz
 
 [testenv:s3acl]
 commands = /bin/bash {posargs:swift3/test/functional/run_test.sh}