diff --git a/doc/requirements.txt b/doc/requirements.txt
index bc02da36353..5d2658ab2b5 100644
--- a/doc/requirements.txt
+++ b/doc/requirements.txt
@@ -1,7 +1,8 @@
 # The order of packages is significant, because pip processes them in the order
 # of appearance. Changing the order has an impact on the overall integration
 # process, which may cause wedges in the gate later.
-sphinx!=1.6.6,>=1.6.2 # BSD
+sphinx!=1.6.6,!=1.6.7,>=1.6.2,<2.0.0;python_version=='2.7'  # BSD
+sphinx!=1.6.6,!=1.6.7,>=1.6.2;python_version>='3.4' # BSD
 openstackdocstheme>=1.18.1 # Apache-2.0
 oslotest>=3.2.0 # Apache-2.0
 reno>=2.5.0 # Apache-2.0
diff --git a/test-requirements.txt b/test-requirements.txt
index dd8819e5f50..3b5df74eb74 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -1,7 +1,7 @@
 # The order of packages is significant, because pip processes them in the order
 # of appearance. Changing the order has an impact on the overall integration
 # process, which may cause wedges in the gate later.
-hacking>=1.1.0 # Apache-2.0
+hacking>=1.1.0,<1.2.0 # Apache-2.0
 
 bandit>=1.1.0,<1.5.0 # Apache-2.0
 coverage!=4.4,>=4.0 # Apache-2.0
diff --git a/tox.ini b/tox.ini
index 93334f55f0c..4c9fdf0d173 100644
--- a/tox.ini
+++ b/tox.ini
@@ -143,7 +143,11 @@ commands = {posargs}
 
 [testenv:docs]
 basepython = python3
-deps = -r{toxinidir}/doc/requirements.txt
+envdir = {toxworkdir}/docs
+deps =
+  -c{env:UPPER_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/rocky}
+  -r{toxinidir}/doc/requirements.txt
+  -r{toxinidir}/requirements.txt
 commands = sphinx-build -W -b html doc/source doc/build/html
 
 [testenv:linkcheck]