diff --git a/requirements/requirements-dev.in b/requirements/requirements-dev.in
index ac942fe..5d9e045 100644
--- a/requirements/requirements-dev.in
+++ b/requirements/requirements-dev.in
@@ -5,7 +5,7 @@ pytest
 pytest-cov
 
 # linting and other static code analysis
-bandit
+bandit==1.6.2               # pinned because 1.7.0 wasn't running right in tox
 dlint
 flake8
 flake8-blind-except
diff --git a/requirements/requirements-dev.txt b/requirements/requirements-dev.txt
index 3c17f2e..b10fc94 100644
--- a/requirements/requirements-dev.txt
+++ b/requirements/requirements-dev.txt
@@ -8,7 +8,7 @@ appdirs==1.4.4
     # via virtualenv
 attrs==20.3.0
     # via pytest
-bandit==1.7.0
+bandit==1.6.2
     # via -r requirements/requirements-dev.in
 bleach==3.2.2
     # via mdx-linkify