diff --git a/blacklist.txt b/blacklist.txt
index 5970820249..94314b6b51 100644
--- a/blacklist.txt
+++ b/blacklist.txt
@@ -1,6 +1,7 @@
 # linters - each project may have a different version with loose convergence
 # over time.
 astroid
+bandit
 flake8
 flake8_docstrings
 flake8-import-order
diff --git a/global-requirements.txt b/global-requirements.txt
index cc42d7e0b9..a6c2119075 100644
--- a/global-requirements.txt
+++ b/global-requirements.txt
@@ -361,7 +361,6 @@ zhmcclient>=0.9.0  # Apache 2.0 License
 
 # Testing tools below, which are typically in test-requires.txt
 
-bandit>=1.1.0  # Apache-2.0
 bashate>=0.5.1 # Apache-2.0
 cliff-tablib>=1.0  # Apache-2.0
 couchdb>=0.8 # Apache-2.0
diff --git a/upper-constraints.txt b/upper-constraints.txt
index 0c04da324b..97dd9fbd43 100644
--- a/upper-constraints.txt
+++ b/upper-constraints.txt
@@ -23,7 +23,6 @@ os-api-ref===1.4.0
 oslo.concurrency===3.23.0
 websocket-client===0.44.0
 osprofiler===1.13.0
-bandit===1.4.0
 tabulate===0.8.1
 python-ironic-inspector-client===2.1.0
 lxml===4.0.0