diff --git a/.circleci/config.yml b/.circleci/config.yml
index e7fd23a1bf9..929f0708dcb 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -18,7 +18,7 @@ jobs:
       - checkout
       - run: git submodule sync
       - run: git submodule update --init
-      - run: pip install --user tox
+      - run: pip install --user 'tox<5'
       - run: tox -e py310
       - codecov/upload
 
@@ -29,7 +29,7 @@ jobs:
       - checkout
       - run: git submodule sync
       - run: git submodule update --init
-      - run: pip install --user tox
+      - run: pip install --user 'tox<4'
       - run: tox -c tox.embedapi.ini
 
   checks:
@@ -41,18 +41,20 @@ jobs:
       - checkout
       - run: git submodule sync
       - run: git submodule update --init
-      - run: pip install --user tox
+      - run: git fetch origin main  # needed for comparisson in pre-commit
+      - run: git branch --track main origin/main  # needed for comparisson in pre-commit
+      - run: pip install --user 'tox<5'
+      - run: tox -e pre-commit
+      - run: tox -e migrations
+      - run: tox -e lint
+      - run: tox -e docs
+      - run: tox -e docs-dev
       - run: scripts/circle/install_node.sh
       - run:
           name: Add node to the path
           command: |
             echo 'export PATH=~/.nvm/versions/node/v${NODE_VERSION}/bin:$PATH' >> $BASH_ENV
             source $BASH_ENV
-      - run: tox -e migrations
-      - run: tox -e pre-commit
-      - run: tox -e lint
-      - run: tox -e docs
-      - run: tox -e docs-dev
       - run: tox -e eslint
 
 workflows:
diff --git a/tox.embedapi.ini b/tox.embedapi.ini
index dad3ddd5d81..5a068f8409a 100644
--- a/tox.embedapi.ini
+++ b/tox.embedapi.ini
@@ -1,4 +1,5 @@
 [tox]
+# NOTE: Currently tox 3 is required, breaks with tox 4, possibly basepython 3.10 needs to be defined
 # NOTE: Sphinx 3.5 and 4.x < 4.2 fails with Python 3.10 because of a typing issue
 #
 # NOTE: Sphinx 1.8 and 2.0 are not tested anymore because of some
@@ -7,10 +8,12 @@ envlist = sphinx-{21,22,23,24,30,31,32,33,34,42,43,44,45,50,latest,24-docutils-0
 
 [testenv]
 description = run test suite for the EmbedAPIv3
+allowlist_externals =
+    sh
 install_command =
     # Install requirements in multiple steps because we don't want to install
     # Sphinx from `requirements/pip.txt` but from the `deps=` field.
-    /bin/sh -c ' \
+    sh -c ' \
         cat {toxinidir}/requirements/pip.txt | grep -v "Sphinx" > {toxinidir}/requirements/embedapi.txt; \
         sed {toxinidir}/requirements/testing.txt -e "s|pip.txt|embedapi.txt|g" > {toxinidir}/requirements/testing.embedapi.txt; \
         pip install -r {toxinidir}/requirements/testing.embedapi.txt; \
diff --git a/tox.ini b/tox.ini
index a849717b723..abe3778d4ff 100644
--- a/tox.ini
+++ b/tox.ini
@@ -18,13 +18,16 @@ deps =
 basepython =
     python3.10
 commands =
-    /bin/sh -c '\
+    sh -c '\
         export DJANGO_SETTINGS_MODULE=readthedocs.settings.test; \
         pytest --cov-report=xml --cov-config .coveragerc --cov=. --pyargs readthedocs --suppress-no-test-exit-code -m "not proxito and not embed_api" {posargs:{env:TOX_POSARGS:-m "not search and not proxito and not embed_api"}}'
 
-    /bin/sh -c '\
+    sh -c '\
         export DJANGO_SETTINGS_MODULE=readthedocs.settings.proxito.test; \
         pytest --cov-report=xml --cov-config .coveragerc --cov=. --cov-append --pyargs readthedocs -m proxito --suppress-no-test-exit-code {posargs}'
+allowlist_externals =
+    sh
+    git
 
 [testenv:docs]
 description = Build readthedocs user documentation
@@ -49,7 +52,7 @@ commands =
 [testenv:migrations]
 description = check for missing migrations
 commands =
-    ./manage.py makemigrations --check --dry-run
+    {base_python} manage.py makemigrations --check --dry-run
 
 [testenv:lint]
 description = run linter (prospector) to ensure the source code corresponds to our coding standards
@@ -75,7 +78,7 @@ commands =
     pre-commit run --from-ref main --to-ref HEAD
 
 [testenv:eslint]
-whitelist_externals = npm
+allowlist_externals = npm
 description = run the JavaScript linter (requires `npm install`)
 commands =
     npm run lint
@@ -83,7 +86,7 @@ commands =
 [testenv:coverage]
 description = shows the coverage report
 deps = coverage
-whitelist_externals = echo
+allowlist_externals = echo
 commands =
     coverage report --show-missing
     coverage html