diff --git a/tox.ini b/tox.ini
index 72bbf0b5f..b8210d3c2 100644
--- a/tox.ini
+++ b/tox.ini
@@ -19,23 +19,28 @@ commands = find . -type f -name "*.pyc" -delete
 whitelist_externals = find
 
 [testenv:pep8]
+basepython = python3
 commands =
   flake8
   bandit -r keystoneclient -x tests -n5
 
 [testenv:bandit]
+basepython = python3
 # NOTE(browne): This is required for the integration test job of the bandit
 # project. Please do not remove.
 commands = bandit -r keystoneclient -x tests -n5
 
 [testenv:venv]
+basepython = python3
 commands = {posargs}
 
 [testenv:cover]
+basepython = python3
 commands = python setup.py testr --coverage --testr-args='{posargs}'
            coverage report
 
 [testenv:debug]
+basepython = python3
 commands = oslo_debug_helper -t keystoneclient/tests {posargs}
 
 [testenv:functional]
@@ -55,10 +60,12 @@ show-source = True
 exclude = .venv,.tox,dist,doc,*egg,build
 
 [testenv:docs]
+basepython = python3
 commands = python setup.py build_sphinx
 deps = -r{toxinidir}/doc/requirements.txt
 
 [testenv:releasenotes]
+basepython = python3
 commands = sphinx-build -a -E -W -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html
 deps = -r{toxinidir}/doc/requirements.txt
 
@@ -67,6 +74,7 @@ import_exceptions =
     keystoneclient.i18n
 
 [testenv:bindep]
+basepython = python3
 # Do not install any requirements. We want this to be fast and work even if
 # system dependencies are missing, since it's used to tell you what system
 # dependencies are missing! This also means that bindep must be installed