diff --git a/requirements.txt b/requirements.txt
index 408dcbbbdd..88eed57cd0 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -23,7 +23,7 @@ alembic
 cryptography>=1.6
 cachecontrol<0.12.7
 cachetools
-pyjwt>=2.0.0,<3.0
+pyjwt>=2.0.0,<2.6.0
 iso8601
 psutil
 fb-re2>=1.0.6
diff --git a/tests/unit/test_merger_repo.py b/tests/unit/test_merger_repo.py
index 64d0a3098c..182dea1201 100644
--- a/tests/unit/test_merger_repo.py
+++ b/tests/unit/test_merger_repo.py
@@ -71,8 +71,11 @@ class TestMergerRepo(ZuulTestCase):
 
         # Forge a repo having a submodule
         parent_repo = git.Repo(parent_path)
-        parent_repo.git.submodule('add', os.path.join(
-            self.upstream_root, 'org/project2'), 'subdir')
+        parent_repo.git(c='protocol.file.allow=always').submodule(
+            'add',
+            os.path.join(self.upstream_root, 'org/project2'),
+            'subdir')
+
         parent_repo.index.commit('Adding project2 as a submodule in subdir')
         # git 1.7.8 changed .git from being a directory to a file pointing
         # to the parent repository /.git/modules/*