diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index a13b03fc41..727383b6ed 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -442,12 +442,31 @@ jobs:
               steps.calc-cache-key-py.outputs.py-hash-key
           }}-
           ${{ runner.os }}-pip-
+
+    - name: Identify tox's own lock file
+      id: tox-deps
+      run: >
+        LOCK_FILE_PATH="requirements/$(
+        python bin/print_lockfile_base_name.py tox
+        ).txt"
+
+
+        echo lock-file="$(
+        ls -1 "${LOCK_FILE_PATH}"
+        || >&2 echo "${LOCK_FILE_PATH}" not found, not injecting...
+        )"
+        >> "${GITHUB_OUTPUT}"
+      shell: bash  # windows compat
+
     - name: Install tox
       run: >-
-        python -m
-        pip install
-        --user
-        tox
+        python -Im pip install -r requirements/tox-tox.in
+        ${{
+          steps.tox-deps.outputs.lock-file
+          && format('--constraint={0}', steps.tox-deps.outputs.lock-file)
+          || ''
+        }}
+      shell: bash  # windows compat
 
     - name: Pre-populate the tox env
       run: >-
diff --git a/.github/workflows/reusable-tox.yml b/.github/workflows/reusable-tox.yml
index c97355bad3..d82783495e 100644
--- a/.github/workflows/reusable-tox.yml
+++ b/.github/workflows/reusable-tox.yml
@@ -224,8 +224,31 @@ jobs:
               steps.calc-cache-key-py.outputs.py-hash-key
           }}-
           ${{ runner.os }}-pip-
+
+    - name: Identify tox's own lock file
+      id: tox-deps
+      run: >
+        LOCK_FILE_PATH="requirements/$(
+        python bin/print_lockfile_base_name.py tox
+        ).txt"
+
+
+        echo lock-file="$(
+        ls -1 "${LOCK_FILE_PATH}"
+        || >&2 echo "${LOCK_FILE_PATH}" not found, not injecting...
+        )"
+        >> "${GITHUB_OUTPUT}"
+      shell: bash  # windows compat
+
     - name: Install tox
-      run: python -Im pip install tox
+      run: >-
+        python -Im pip install -r requirements/tox-tox.in
+        ${{
+          steps.tox-deps.outputs.lock-file
+          && format('--constraint={0}', steps.tox-deps.outputs.lock-file)
+          || ''
+        }}
+      shell: bash  # windows compat
 
     - name: Make the env clean of non-test files
       if: inputs.toxenv == 'metadata-validation'