diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c117055aca..c3a51ca3a1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,7 +29,7 @@ jobs:
       - uses: actions/setup-python@v2
         with:
           python-version: '3.10'
-      - run: pip install tox==3.24.4
+      - run: pip install -U -r requirements-bootstrap.txt
       - run: tox -e ${{ matrix.toxenv }}
   k8s_itests:
     runs-on: ubuntu-20.04
@@ -40,10 +40,8 @@ jobs:
       - uses: actions/setup-python@v2
         with:
           python-version: '3.10'
-      - run: python -m pip install --upgrade pip virtualenv
+      - run: pip install -U -r requirements-bootstrap.txt
       - run: curl -LO https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl && chmod +x kubectl && sudo mv kubectl /usr/local/bin/
-      - run: python -m pip install --upgrade pip
-      - run: pip install ephemeral-port-reserve
       - run: make k8s_itests
   build_debs:
     runs-on: ubuntu-20.04
diff --git a/.github/workflows/pypi.yml b/.github/workflows/pypi.yml
index 60920d07e4..583c2f5079 100644
--- a/.github/workflows/pypi.yml
+++ b/.github/workflows/pypi.yml
@@ -22,7 +22,7 @@ jobs:
       - uses: actions/setup-python@v2
         with:
           python-version: 3.7
-      - run: python -m pip install --upgrade pip
+      - run: pip install -U -r requirements-bootstrap.txt
       - run: tox -e ${{ matrix.toxenv }}
   pypi:
     # lets run tests before we push anything to pypi, much like we do internally
diff --git a/Makefile b/Makefile
index 10c61994ce..558dfd7676 100644
--- a/Makefile
+++ b/Makefile
@@ -32,36 +32,41 @@ endif
 
 .PHONY: all docs test itest k8s_itests quick-test
 
-dev:
-	tox
+dev: .paasta/bin/activate
+	.paasta/bin/tox
 
-docs:
-	tox -e docs
+docs: .paasta/bin/activate
+	.paasta/bin/tox -e docs
 
-test:
+test: .paasta/bin/activate
 	if [ "$(PAASTA_ENV)" != "YELP" ]; then \
-		tox -e tests; \
+		.paasta/bin/tox -e tests; \
 	else \
-		tox -e tests-yelpy; \
+		.paasta/bin/tox -e tests-yelpy; \
 	fi
 
-test-yelpy:
-	tox -e tests-yelpy
+test-yelpy: .paasta/bin/activate
+	.paasta/bin/tox -e tests-yelpy
 
-test-not-yelpy:
-	tox -e tests
+test-not-yelpy: .paasta/bin/activate
+	.paasta/bin/tox -e tests
 
 quick-test: .tox/py38-linux
 	TZ=UTC .tox/py38-linux/bin/py.test --failed-first -x --disable-warnings -- tests
 
-.tox/py38-linux:
-	tox
+.tox/py38-linux: .paasta/bin/activate
+	.paasta/bin/tox
 
 dev-api: .tox/py38-linux
-	tox -e dev-api
+	.paasta/bin/tox -e dev-api
 
-itest: test
-	tox -e general_itests
+.paasta/bin/activate: requirements.txt requirements-dev.txt
+	test -d .paasta/bin/activate || virtualenv -p python3.8 .paasta
+	.paasta/bin/pip install -U -r requirements-bootstrap.txt
+	touch .paasta/bin/activate
+
+itest: test .paasta/bin/activate
+	.paasta/bin/tox -e general_itests
 
 itest_%:
 	# See the makefile in yelp_package/Makefile for packaging stuff
@@ -91,7 +96,7 @@ help:
 install-hooks:
 	tox -e install-hooks
 
-k8s_itests:
+k8s_itests: .paasta/bin/activate
 	make -C k8s_itests all
 
 .PHONY: k8s_fake_cluster
@@ -99,7 +104,7 @@ k8s_fake_cluster: .tox/py38-linux
 	make -C k8s_itests .fake_cluster
 
 .PHONY: k8s_clean
-k8s_clean:
+k8s_clean: .paasta/bin/activate
 	make -C k8s_itests clean
 
 # image source: openapitools/openapi-generator-cli:latest
@@ -126,10 +131,10 @@ swagger-validate:
 		-i paasta_tools/api/api_docs/swagger.json
 
 .PHONY: vscode_settings
-vscode_settings: .tox/py38-linux
-	.tox/py38-linux/bin/python paasta_tools/contrib/ide_helper.py
+vscode_settings: .paasta/bin/activate .tox/py38-linux
+	.paasta/bin/python paasta_tools/contrib/ide_helper.py
 
-etc_paasta_playground soa_config_playground: .tox/py38-linux
+etc_paasta_playground soa_config_playground: .paasta/bin/activate .tox/py38-linux
 	.tox/py38-linux/bin/python paasta_tools/contrib/create_paasta_playground.py
 
 .PHONY: generate_deployments_for_service
@@ -142,7 +147,7 @@ generate_deployments_for_service: | soa_config_playground .tox/py38-linux
 
 .PHONY: playground-api
 playground-api: .tox/py38-linux | soa_config_playground
-	tox -e playground-api
+	.paasta/bin/tox -e playground-api
 
 .PHONY: setup-kubernetes-job
 setup-kubernetes-job: k8s_fake_cluster generate_deployments_for_service
diff --git a/requirements-bootstrap.txt b/requirements-bootstrap.txt
new file mode 100644
index 0000000000..674c481464
--- /dev/null
+++ b/requirements-bootstrap.txt
@@ -0,0 +1,6 @@
+ephemeral-port-reserve==1.1.4
+pip==22.0.4
+setuptools==69.1.0
+tox==3.7.0
+tox-pip-extensions==1.4.2
+virtualenv==16.2.0
diff --git a/tox.ini b/tox.ini
index 72b11c3cf6..465c8c5326 100644
--- a/tox.ini
+++ b/tox.ini
@@ -2,13 +2,6 @@
 skipsdist=True
 envlist=py38-linux
 docker_compose_version = 1.26.2
-requires=
-    tox==3.7.0
-    tox-pip-extensions==1.4.2
-    setuptools==69.1.0
-    pip==22.0.4
-    virtualenv==16.2.0
-    ephemeral-port-reserve==1.1.4
 
 [testenv]
 basepython = python3.8