diff --git a/.ansible-lint b/.ansible-lint
index 4b2817d1f..962ed2b61 100644
--- a/.ansible-lint
+++ b/.ansible-lint
@@ -7,4 +7,5 @@ skip_list:
   - '702'  # Tags must contain lowercase letters and digits only
   # NOTE(dtantsur): the following rules should likely stay excluded:
   - '106'  # Role name {} does not match ``^[a-z][a-z0-9_]+$`` pattern'
+  - '403'  # Package installs should not use latest
   - '503'  # Tasks that run when changed should likely be handlers
diff --git a/lower-constraints.txt b/lower-constraints.txt
index 3247191e3..9bd0e03c6 100644
--- a/lower-constraints.txt
+++ b/lower-constraints.txt
@@ -9,14 +9,13 @@ cmd2==0.8.9
 coverage==4.0
 cryptography==2.2.1
 debtcollector==1.19.0
-doc8==0.6.0
 docutils==0.14
 extras==1.0.0
 fixtures==3.0.0
 future==0.18.2
 idna==2.6
 iso8601==0.1.12
-keystoneauth1==3.4.0
+keystoneauth1==3.18.0
 linecache2==1.0.0
 monotonic==1.4
 mox3==0.25.0
@@ -36,7 +35,6 @@ pbr==2.0.0
 prettytable==0.7.2
 pyasn1==0.4.2
 pycparser==2.18
-Pygments==2.2.0
 pyinotify==0.9.6
 pyOpenSSL==18.0.0
 pyparsing==2.2.0
diff --git a/playbooks/roles/bifrost-create-vm-nodes/tasks/main.yml b/playbooks/roles/bifrost-create-vm-nodes/tasks/main.yml
index 3c0d10032..d35aaddda 100644
--- a/playbooks/roles/bifrost-create-vm-nodes/tasks/main.yml
+++ b/playbooks/roles/bifrost-create-vm-nodes/tasks/main.yml
@@ -35,6 +35,13 @@
     name: "{{ required_packages }}"
     state: present
 
+# NOTE(dtantsur): workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1840485
+- name: "Work around libgrypt issue on RHEL/CentOS 8.3"
+  package:
+    name: libgcrypt
+    state: latest
+  when: ansible_distribution in ['RedHat', 'CentOS']
+
 - name: ensure installation root folder exists
   become: yes
   file:
diff --git a/test-requirements.txt b/test-requirements.txt
index 337a1804f..c7480dfa0 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -2,14 +2,8 @@
 # of appearance. Changing the order has an impact on the overall integration
 # process, which may cause wedges in the gate later.
 
-hacking>=3.1.0,<4.0.0 # Apache-2.0
-
 coverage!=4.4,>=4.0 # Apache-2.0
-doc8>=0.6.0 # Apache-2.0
 stestr>=2.0.0 # Apache-2.0
 testtools>=2.2.0 # MIT
-Pygments>=2.2.0 # BSD license
-flake8-import-order>=0.17.1 # LGPLv3
-pycodestyle>=2.0.0,<2.7.0 # MIT
 
 openstacksdk>=0.37.0 # Apache-2.0
diff --git a/tox.ini b/tox.ini
index 5874b1f9a..4179de927 100644
--- a/tox.ini
+++ b/tox.ini
@@ -18,6 +18,12 @@ commands = stestr run --slowest {posargs}
 passenv = http_proxy HTTP_PROXY https_proxy HTTPS_PROXY no_proxy NO_PROXY
 
 [testenv:pep8]
+deps =
+    Pygments>=2.2.0 # BSD license
+    doc8>=0.6.0 # Apache-2.0
+    flake8-import-order>=0.17.1 # LGPLv3
+    hacking>=3.1.0,<4.0.0 # Apache-2.0
+    pycodestyle>=2.0.0,<2.7.0 # MIT
 commands =
     flake8 {posargs}
     doc8 doc/source releasenotes/source README.rst CONTRIBUTING.rst MISSION.rst HACKING.rst