diff --git a/.travis.yml b/.travis.yml
index 77666eace5d2..af5193f373c6 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -35,12 +35,7 @@ script:
   - export TRAVIS_HQ_USERNAME=$TRAVIS_HQ_USERNAME
   - export TRAVIS_HQ_PASSWORD=$TRAVIS_HQ_PASSWORD
   - export DATADOG_API_KEY=$DATADOG_API_KEY
-  - |
-    if [[ "$TEST_MAKE_REQUIREMENTS" == "yes" ]]
-    then
-      bash scripts/test-make-requirements.sh
-    fi
-  - "scripts/docker test --noinput --stop --verbosity=2 --divide-depth=1 --with-timing --threshold=10"
+  - scripts/run-tests.sh
 after_success:
   # create symlink so artifacts are available
   - sudo ln -s $(pwd) /mnt/commcare-hq-ro
diff --git a/requirements-python3/dev-requirements.txt b/requirements-python3/dev-requirements.txt
index 83ce7e11c0eb..6779791c8f7f 100644
--- a/requirements-python3/dev-requirements.txt
+++ b/requirements-python3/dev-requirements.txt
@@ -134,7 +134,7 @@ pexpect==4.7.0            # via ipython
 phonenumberslite==8.10.10
 pickleshare==0.7.5        # via ipython
 pillow==6.0.0
-pip-tools==3.6.1
+pip-tools==3.8.0
 ply==3.11
 polib==1.1.0
 prompt-toolkit==1.0.16    # via ipython
@@ -220,3 +220,6 @@ wheel==0.29.0
 wrapt==1.11.1
 xlrd==1.0.0
 xlwt==1.3.0
+
+# The following packages are considered to be unsafe in a requirements file:
+# setuptools==41.0.1        # via django-websocket-redis, ipdb, ipython, python-levenshtein, python-termstyle, sphinx
diff --git a/requirements-python3/requirements.txt b/requirements-python3/requirements.txt
index 3f59db97079c..1e58bb04b02a 100644
--- a/requirements-python3/requirements.txt
+++ b/requirements-python3/requirements.txt
@@ -161,3 +161,6 @@ werkzeug==0.11.15
 wrapt==1.11.1             # via ddtrace
 xlrd==1.0.0
 xlwt==1.3.0
+
+# The following packages are considered to be unsafe in a requirements file:
+# setuptools==41.0.1        # via django-websocket-redis, python-levenshtein
diff --git a/requirements-python3/test-requirements.txt b/requirements-python3/test-requirements.txt
index 321f7e33d35b..80e9f777f362 100644
--- a/requirements-python3/test-requirements.txt
+++ b/requirements-python3/test-requirements.txt
@@ -177,3 +177,6 @@ werkzeug==0.11.15
 wrapt==1.11.1
 xlrd==1.0.0
 xlwt==1.3.0
+
+# The following packages are considered to be unsafe in a requirements file:
+# setuptools==41.0.1        # via django-websocket-redis, python-levenshtein
diff --git a/requirements/dev-requirements.in b/requirements/dev-requirements.in
index acffbc2f4782..acd87d0bd26f 100644
--- a/requirements/dev-requirements.in
+++ b/requirements/dev-requirements.in
@@ -14,7 +14,7 @@ graphviz==0.7
 transifex-client==0.12.4
 modernize
 gnureadline==6.3.8
-pip-tools~=3.0
+pip-tools>=3.8
 
 # documentation
 Sphinx~=1.8
diff --git a/requirements/dev-requirements.txt b/requirements/dev-requirements.txt
index 60b0d9ba25f5..97f1d7744249 100644
--- a/requirements/dev-requirements.txt
+++ b/requirements/dev-requirements.txt
@@ -135,7 +135,7 @@ pexpect==4.7.0            # via ipython
 phonenumberslite==8.10.10
 pickleshare==0.7.5        # via ipython
 pillow==6.0.0
-pip-tools==3.6.1
+pip-tools==3.8.0
 ply==3.11
 polib==1.1.0
 prompt-toolkit==1.0.16    # via ipython
@@ -221,3 +221,6 @@ wheel==0.29.0
 wrapt==1.11.1
 xlrd==1.0.0
 xlwt==1.3.0
+
+# The following packages are considered to be unsafe in a requirements file:
+# setuptools==41.0.1        # via django-websocket-redis, ipdb, ipython, python-levenshtein, python-termstyle, sphinx
diff --git a/requirements/requirements.txt b/requirements/requirements.txt
index c2c786dfd4c2..cd83286b00b0 100644
--- a/requirements/requirements.txt
+++ b/requirements/requirements.txt
@@ -162,3 +162,6 @@ werkzeug==0.11.15
 wrapt==1.11.1             # via ddtrace
 xlrd==1.0.0
 xlwt==1.3.0
+
+# The following packages are considered to be unsafe in a requirements file:
+# setuptools==41.0.1        # via django-websocket-redis, python-levenshtein
diff --git a/requirements/test-requirements.txt b/requirements/test-requirements.txt
index ba300dc19f96..3e0e37ea38ce 100644
--- a/requirements/test-requirements.txt
+++ b/requirements/test-requirements.txt
@@ -178,3 +178,6 @@ werkzeug==0.11.15
 wrapt==1.11.1
 xlrd==1.0.0
 xlwt==1.3.0
+
+# The following packages are considered to be unsafe in a requirements file:
+# setuptools==41.0.1        # via django-websocket-redis, python-levenshtein
diff --git a/scripts/run-tests.sh b/scripts/run-tests.sh
new file mode 100755
index 000000000000..efa6310d8cc1
--- /dev/null
+++ b/scripts/run-tests.sh
@@ -0,0 +1,7 @@
+#! /usr/bin/env bash
+
+set -ex  # fail fast, print commands as they are executed
+
+[[ "$TEST_MAKE_REQUIREMENTS" == "yes" ]] && scripts/test-make-requirements.sh
+
+scripts/docker test --noinput --stop --verbosity=2 --divide-depth=1 --with-timing --threshold=10
diff --git a/scripts/test-make-requirements.sh b/scripts/test-make-requirements.sh
old mode 100644
new mode 100755
index 4464e8337a9f..1dac56ed482a
--- a/scripts/test-make-requirements.sh
+++ b/scripts/test-make-requirements.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -e
 
-pip install pip-tools==3.6.1
+pip install pip-tools>=3.8
 make requirements
 git diff
 git update-index -q --refresh