diff --git a/actions/actions.py b/actions/actions.py
index a49d345..40f4761 100755
--- a/actions/actions.py
+++ b/actions/actions.py
@@ -67,7 +67,7 @@ def get_action_parser(actions_yaml_path, action_name,
                       get_services=services):
     """Make an argparse.ArgumentParser seeded from actions.yaml definitions."""
     with open(actions_yaml_path) as fh:
-        doc = yaml.load(fh)[action_name]["description"]
+        doc = yaml.safe_load(fh)[action_name]["description"]
     parser = argparse.ArgumentParser(description=doc)
     parser.add_argument("--services", default=get_services())
     # TODO: Add arguments for params defined in the actions.yaml
diff --git a/test-requirements.txt b/test-requirements.txt
index dba2c76..856887a 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -7,6 +7,7 @@
 #       requirements.  They are intertwined.  Also, Zaza itself should specify
 #       all of its own requirements and if it doesn't, fix it there.
 #
+cffi==1.14.6; python_version < '3.6'  # cffi 1.15.0 drops support for py35.
 setuptools<50.0.0  # https://github.com/pypa/setuptools/commit/04e3df22df840c6bb244e9b27bc56750c44b7c85
 
 requests>=2.18.4