diff --git a/tox.ini b/tox.ini
index 701d74d9d9..593d553e8b 100644
--- a/tox.ini
+++ b/tox.ini
@@ -157,6 +157,14 @@ commands = {envpython} {toxinidir}/manage.py {posargs}
 basepython = python3
 commands = {envpython} {toxinidir}/manage.py runserver {posargs}
 
+[testenv:bandit]
+basepython = python3
+commands = bandit -r horizon openstack_auth openstack_dashboard -n5 -x tests -ll
+
+[testenv:bandit-baseline]
+envdir = {toxworkdir}/bandit
+basepython = python3
+
 [flake8]
 filename = *.py,django.wsgi
 exclude = .git,.tox,dist,*lib/python*,*egg,build,panel_template,dash_template,local_settings.py,*/local/*,*/test/test_plugins/*,.ropeproject,node_modules,openstack_dashboard/enabled/*
@@ -176,12 +184,6 @@ application-import-names = horizon,openstack_dashboard
 
 [hacking]
 local-check-factory = horizon.hacking.checks.factory
-
-[testenv:bandit]
-commands = bandit -r horizon openstack_auth openstack_dashboard -n5 -x tests -ll
-
-[testenv:bandit-baseline]
-envdir = {toxworkdir}/bandit
 commands = bandit-baseline -r horizon  openstack_auth openstack_dashboard -n5 -x tests -ii -ll
 
 [doc8]