diff --git a/tox.ini b/tox.ini
index be7fd19a..62eb2f9f 100644
--- a/tox.ini
+++ b/tox.ini
@@ -35,19 +35,21 @@ setenv =
 # is same in the CLI output on all platforms
 commands_pre =
     {envbindir}/python -c "import rpm"
-    pip install -I coverage
 
 [testenv:py3]
+deps =
+    coverage
+allowlist_externals = coverage3
 setenv = 
     {[testenv]setenv}
     PYTHONPATH=.:plugins/hub/.:plugins/builder/.:plugins/cli/.:cli/.:www/lib
 commands_pre =
     {[testenv]commands_pre}
-    {envbindir}/coverage3 erase --rcfile .coveragerc3
+    coverage3 erase --rcfile .coveragerc3
 commands = 
-    {envbindir}/coverage3 run --rcfile .coveragerc3 --source . -m pytest {posargs}
-    {envbindir}/coverage3 report --rcfile .coveragerc3
-    {envbindir}/coverage3 html -d {toxinidir}/htmlcov/py3 --rcfile .coveragerc3
+    coverage3 run --rcfile .coveragerc3 --source . -m pytest {posargs}
+    coverage3 report --rcfile .coveragerc3
+    coverage3 html -d {toxinidir}/htmlcov/py3 --rcfile .coveragerc3
 
 [testenv:py2]
 setenv = 
@@ -90,6 +92,7 @@ usedevelop=true
 # B608 - hardcoded SQL - not everything is turned into Processors
 deps =
     bandit
+allowlist_externals = bandit
 commands =
     bandit -ll -s B108,B608 -r \
         builder cli kojihub koji plugins util vm www \