diff --git a/tox.ini b/tox.ini
index 6e50fc25c..3e0df85d4 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,7 +1,6 @@
 [tox]
 minversion = 3.1
 envlist = py3,pep8
-skipsdist = True
 ignore_basepython_conflict = True
 
 [testenv]
@@ -9,8 +8,10 @@ basepython = python3
 usedevelop = True
 passenv =
     HOME
-whitelist_externals =
+allowlist_externals =
     bash
+    make
+    python3
     rm
 setenv =
    VIRTUAL_ENV={envdir}
@@ -32,12 +33,12 @@ deps =
     -r{toxinidir}/doc/requirements.txt
     -r{toxinidir}/test-requirements.txt
 commands =
-  {toxinidir}/tools/run-bashate.sh
+  bash {toxinidir}/tools/run-bashate.sh
   flake8 {posargs} kayobe
   # Check the *.rst files
   # We use a thin wrapper around doc8 currently, which has support for sphinx
   # directives.
-  {toxinidir}/tools/sphinx8 README.rst CONTRIBUTING.rst doc/source --ignore D001
+  python3 {toxinidir}/tools/sphinx8 README.rst CONTRIBUTING.rst doc/source --ignore D001
   yamllint etc/kayobe
 
 [testenv:venv]
@@ -53,21 +54,19 @@ commands = {posargs}
 sitepackages = True
 commands =
     # Install ansible role dependencies from Galaxy.
-    {toxinidir}/tools/ansible-galaxy-retried.sh install \
+    bash {toxinidir}/tools/ansible-galaxy-retried.sh install \
         -r {toxinidir}/requirements.yml \
         -p {toxinidir}/ansible/roles
-    {toxinidir}/tools/test-ansible.sh {posargs}
+    bash {toxinidir}/tools/test-ansible.sh {posargs}
 
 [testenv:molecule]
 deps =
     -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/zed}
     -r{toxinidir}/requirements.txt
     -r{toxinidir}/molecule-requirements.txt
-whitelist_externals =
-    bash
 commands =
     # Install ansible role dependencies from Galaxy.
-    {toxinidir}/tools/ansible-galaxy-retried.sh install \
+    bash {toxinidir}/tools/ansible-galaxy-retried.sh install \
         -r {toxinidir}/requirements.yml \
         -p {toxinidir}/ansible/roles
     bash -c "source {envdir}/bin/activate && {toxinidir}/tools/test-molecule.sh {posargs}"
@@ -78,7 +77,7 @@ commands = /bin/bash -c "ansible-lint {toxinidir}/ansible/*.yml"
 [testenv:ansible-syntax]
 commands =
     # Install ansible role dependencies from Galaxy.
-    {toxinidir}/tools/ansible-galaxy-retried.sh install \
+    bash {toxinidir}/tools/ansible-galaxy-retried.sh install \
         -r {toxinidir}/requirements.yml \
         -p {toxinidir}/ansible/roles
     # Perform an Ansible syntax check. Skip some playbooks which require extra
@@ -117,7 +116,6 @@ commands =
   whereto doc/source/_extra/.htaccess doc/test/redirect-tests.txt
 
 [testenv:pdf-docs]
-whitelist_externals = make
 deps = {[testenv:docs]deps}
 commands =
   rm -rf doc/build/pdf