diff --git a/tox.ini b/tox.ini
index e5d2b13ec6..968620b3cd 100644
--- a/tox.ini
+++ b/tox.ini
@@ -5,7 +5,7 @@ envlist = py34,py27,pep8,docs,genconfig,releasenotes
 
 [testenv]
 usedevelop = True
-install_command = pip install -U {opts} {packages}
+install_command = pip install -c{env:UPPER_CONSTRAINTS_FILE:https://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt?h=stable/mitaka} {opts} {packages}
 setenv = VIRTUAL_ENV={envdir}
 deps = -r{toxinidir}/test-requirements.txt
        .[ldap,memcache,mongodb]
@@ -60,6 +60,12 @@ deps = .[bandit]
 commands = bandit -r keystone -x tests
 
 [testenv:cover]
+# Also do not run test_coverage_ext tests while gathering coverage as those
+# tests conflict with coverage.
+# NOTE(sdague): this target does not use constraints because
+# upstream infra does not yet support it. Once that's fixed, we can
+# drop the install_command.
+install_command = pip install -U --force-reinstall {opts} {packages}
 commands =
   find keystone -type f -name "*.pyc" -delete
   python setup.py testr --coverage --testr-args='{posargs}'
@@ -127,6 +133,10 @@ commands=
     python setup.py build_sphinx
 
 [testenv:releasenotes]
+# NOTE(sdague): this target does not use constraints because
+# upstream infra does not yet support it. Once that's fixed, we can
+# drop the install_command.
+install_command = pip install -U --force-reinstall {opts} {packages}
 commands = sphinx-build -a -E -W -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html
 
 [testenv:genconfig]