diff --git a/Dockerfile b/Dockerfile
index e154f6e4a..1857efb9b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -39,6 +39,7 @@ RUN apt-mark manual python-minimal
 # Install requirements separately, because pip understands a git+https url
 # while setuptools doesn't
 RUN proxy.sh pip install --upgrade pip
+# TODO(jroll) use upper-constraints here
 RUN proxy.sh pip install --no-cache-dir -r /tmp/ironic-python-agent/requirements.txt
 
 # This will succeed because all the dependencies were installed previously
diff --git a/tox.ini b/tox.ini
index fa1c28a88..beba1a075 100644
--- a/tox.ini
+++ b/tox.ini
@@ -5,7 +5,7 @@ envlist = py34,py27,func,pep8
 
 [testenv]
 usedevelop = True
-install_command = pip install --allow-external -U {opts} {packages}
+install_command = pip install -U -c{env:UPPER_CONSTRAINTS_FILE:https://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt} {opts} {packages}
 setenv =
   VIRTUAL_ENV={envdir}
   OS_TEST_PATH=./ironic_python_agent/tests/unit
@@ -29,11 +29,23 @@ commands =
   doc8 doc/source README.rst
 
 [testenv:cover]
+# NOTE(amrith) The setting of the install_command in this location
+# is only required because currently infra does not actually
+# support constraints files for the cover job, and while
+# the environment variable UPPER_CONSTRAINTS_FILE is set, there's
+# no file there. It can be removed when infra changes this.
+install_command = pip install -U {opts} {packages}
 setenv = VIRTUAL_ENV={envdir}
 commands =
   python setup.py test --coverage --coverage-package-name ironic_python_agent {posargs}
 
 [testenv:venv]
+# NOTE(amrith) The setting of the install_command in this location
+# is only required because currently infra does not actually
+# support constraints files for the docs job, and while
+# the environment variable UPPER_CONSTRAINTS_FILE is set, there's
+# no file there. It can be removed when infra changes this.
+install_command = pip install -U {opts} {packages}
 setenv = PYTHONHASHSEED=0
 commands = {posargs:}
 
@@ -49,6 +61,12 @@ commands =
   python setup.py build_sphinx
 
 [testenv:releasenotes]
+# NOTE(amrith) The setting of the install_command in this location
+# is only required because currently infra does not actually
+# support constraints files for the releasenotes job, and while
+# the environment variable UPPER_CONSTRAINTS_FILE is set, there's
+# no file there. It can be removed when infra changes this.
+install_command = pip install -U {opts} {packages}
 envdir = {toxworkdir}/venv
 commands = sphinx-build -a -E -W -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html