diff --git a/promenade/pki.py b/promenade/pki.py
index cd5cd22b..e05e9e45 100644
--- a/promenade/pki.py
+++ b/promenade/pki.py
@@ -42,8 +42,8 @@ class PKI:
             })
         self.certificate_authorities[ca_name] = result
 
-        return (self._wrap_ca(ca_name, result['cert']), self._wrap_ca_key(
-            ca_name, result['key']))
+        return (self._wrap_ca(ca_name, result['cert']),
+                self._wrap_ca_key(ca_name, result['key']))
 
     def generate_keypair(self, name):
         priv_result = self._openssl(['genrsa', '-out', 'priv.pem'])
@@ -69,8 +69,8 @@ class PKI:
                 'csr.json': self.csr(name=cn, groups=groups, hosts=hosts),
             })
 
-        return (self._wrap_cert(name, result['cert']), self._wrap_cert_key(
-            name, result['key']))
+        return (self._wrap_cert(name, result['cert']),
+                self._wrap_cert_key(name, result['key']))
 
     def csr(self,
             *,
diff --git a/tox.ini b/tox.ini
index d0905d66..fd0edbbe 100644
--- a/tox.ini
+++ b/tox.ini
@@ -11,7 +11,7 @@ commands=
     {posargs}
 
 [testenv:bandit]
-deps = bandit
+deps = bandit==1.4.0
 commands =
     bandit -r promenade
 
@@ -22,7 +22,7 @@ commands =
     python setup.py build_sphinx {posargs}
 
 [testenv:fmt]
-deps = yapf
+deps = yapf==0.20.0
 commands =
     yapf -ir {toxinidir}/promenade
 
@@ -35,15 +35,15 @@ commands=
 
 [testenv:gate-lint]
 deps =
-    jsonschema
+    jsonschema==2.6.0
 whitelist_externals = sh
 commands =
     {toxinidir}/tools/lint_gate.sh
 
 [testenv:lint]
 deps =
-    yapf
-    flake8
+    yapf==0.20.0
+    flake8==3.5.0
 commands =
     yapf -rd {toxinidir}/promenade
     flake8 {toxinidir}/promenade