diff --git a/tox.ini b/tox.ini
index 6fadc4948..b9e6a65aa 100644
--- a/tox.ini
+++ b/tox.ini
@@ -9,11 +9,10 @@ basepython = python3
 usedevelop = True
 whitelist_externals = find
                       rm
-install_command = pip install {opts} {packages}
+install_command = pip install -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master} {opts} {packages}
 setenv =
    VIRTUAL_ENV={envdir}
 deps =
-    -c{env:UPPER_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
     -r{toxinidir}/test-requirements.txt
     -r{toxinidir}/requirements.txt
 commands =
@@ -31,7 +30,6 @@ commands =
 [testenv:venv]
 setenv = PYTHONHASHSEED=0
 deps =
-    -c{env:UPPER_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
     -r{toxinidir}/doc/requirements.txt
     -r{toxinidir}/test-requirements.txt
     -r{toxinidir}/requirements.txt
@@ -50,7 +48,6 @@ commands =
 [testenv:docs]
 setenv = PYTHONHASHSEED=0
 deps =
-  -c{env:UPPER_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
   -r{toxinidir}/doc/requirements.txt
 commands =
   rm -fr doc/build doc/source/api/ .autogenerated
@@ -75,6 +72,28 @@ commands =
 commands =
     oslopolicy-sample-generator --config-file etc/watcher/oslo-policy-generator/watcher-policy-generator.conf
 
+[testenv:wheel]
+commands = python setup.py bdist_wheel
+
+[testenv:pdf-docs]
+envdir = {toxworkdir}/docs
+deps = {[testenv:docs]deps}
+whitelist_externals =
+  rm
+  make
+commands =
+  rm -rf doc/build/pdf
+  sphinx-build -W --keep-going -b latex doc/source doc/build/pdf
+  make -C doc/build/pdf
+
+[testenv:releasenotes]
+deps = -r{toxinidir}/doc/requirements.txt
+commands = sphinx-build -a -W -E -d releasenotes/build/doctrees --keep-going -b html releasenotes/source releasenotes/build/html
+
+[testenv:bandit]
+deps = -r{toxinidir}/test-requirements.txt
+commands = bandit -r watcher -x watcher/tests/* -n5 -ll -s B320
+
 [flake8]
 filename = *.py,app.wsgi
 show-source=True
@@ -84,9 +103,6 @@ builtins= _
 enable-extensions = H106,H203,H904
 exclude=.venv,.git,.tox,dist,doc,*lib/python*,*egg,build,*sqlalchemy/alembic/versions/*,demo/,releasenotes
 
-[testenv:wheel]
-commands = python setup.py bdist_wheel
-
 [hacking]
 import_exceptions = watcher._i18n
 
@@ -110,27 +126,7 @@ extension =
    N366 = checks:import_stock_mock
 paths = ./watcher/hacking
 
-
 [doc8]
 extension=.rst
 # todo: stop ignoring doc/source/man when https://bugs.launchpad.net/doc8/+bug/1502391 is fixed
 ignore-path=doc/source/image_src,doc/source/man,doc/source/api
-
-[testenv:pdf-docs]
-envdir = {toxworkdir}/docs
-deps = {[testenv:docs]deps}
-whitelist_externals =
-  rm
-  make
-commands =
-  rm -rf doc/build/pdf
-  sphinx-build -W --keep-going -b latex doc/source doc/build/pdf
-  make -C doc/build/pdf
-
-[testenv:releasenotes]
-deps = -r{toxinidir}/doc/requirements.txt
-commands = sphinx-build -a -W -E -d releasenotes/build/doctrees --keep-going -b html releasenotes/source releasenotes/build/html
-
-[testenv:bandit]
-deps = -r{toxinidir}/test-requirements.txt
-commands = bandit -r watcher -x watcher/tests/* -n5 -ll -s B320