diff --git a/tox.ini b/tox.ini
index 1bbd9639c1..9f4ec03d97 100644
--- a/tox.ini
+++ b/tox.ini
@@ -4,7 +4,13 @@ envlist = linters,gerrit,grafyaml
 skipsdist = True
 
 [testenv]
-passenv = http_proxy HTTP_PROXY https_proxy HTTPS_PROXY no_proxy NO_PROXY
+passenv =
+    http_proxy
+    HTTP_PROXY
+    https_proxy
+    HTTPS_PROXY
+    no_proxy
+    NO_PROXY
 basepython = python3
 
 [testenv:linters]
@@ -47,6 +53,10 @@ commands =
   python -c 'import yaml ; yaml.safe_load(open("zuul/site-variables.yaml", "r"))'
 
 [testenv:gerrit]
+allowlist_externals =
+  {toxinidir}/tools/check_valid_gerrit_projects.py
+  {toxinidir}/tools/check_projects_yaml_alphabetized.sh
+  {toxinidir}/tools/check_valid_gerrit_config.sh
 deps =
     PyYAML
     ruamel.yaml
@@ -60,6 +70,10 @@ commands =
 commands = {posargs}
 
 [testenv:irc]
+allowlist_externals =
+  {toxinidir}/tools/check_irc_access.py
+  {toxinidir}/tools/irc_tests.py
+  {toxinidir}/tools/check-channels-yaml.sh
 deps =
     PyYAML
     ruamel.yaml
@@ -90,18 +104,24 @@ deps = bindep
 commands = bindep test
 
 [testenv:infra-docs]
+allowlist_externals =
+  {toxinidir}/docs-site/generate_infra_index.py
 deps =
    Jinja2
    PyYAML
 commands = {toxinidir}/docs-site/generate_infra_index.py {toxinidir}/docs-site/infra-documents.yaml
 
 [testenv:specs]
+allowlist_externals =
+  {toxinidir}/specs/generate_specs_site.py
 deps =
    Jinja2
    PyYAML
 commands = {toxinidir}/specs/generate_specs_site.py {toxinidir}/specs/specs.yaml
 
 [testenv:dib]
+allowlist_externals =
+  env
 deps =
    diskimage-builder
    yamllint
@@ -109,6 +129,8 @@ changedir = {toxinidir}/nodepool
 commands = env ELEMENTS_DIR=elements dib-lint
 
 [testenv:nodepool]
+allowlist_externals =
+  {toxinidir}/tools/nodepool-validate.sh
 deps = nodepool
 commands =
   {toxinidir}/tools/nodepool-validate.sh
@@ -123,6 +145,8 @@ commands =
   git diff-files --quiet
 
 [testenv:normalize-projects-yaml]
+allowlist_externals =
+  {toxinidir}/tools/normalize_projects_yaml.py
 deps =
   ruamel.yaml
 commands =