diff --git a/lower-constraints.txt b/lower-constraints.txt
index 23c13a2f013eee074d12445b906f88427929066f..f9dcbaa0dda415f35456915b7581c589768b4cbd 100644
--- a/lower-constraints.txt
+++ b/lower-constraints.txt
@@ -3,6 +3,7 @@ amqp==2.1.1
 appdirs==1.4.0
 asn1crypto==0.23.0
 Babel==2.3.4
+bandit==1.4.0
 cachetools==2.0.0
 cffi==1.7.0
 chardet==3.0.4
diff --git a/test-requirements.txt b/test-requirements.txt
index 3e33d214da778ba38eb429c0146769ff57add158..b0c9e44668543eddfc6b0b78f2955fbf8469b44f 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -10,7 +10,7 @@
 hacking>=1.1.0 # Apache-2.0
 #
 astroid==2.1.0;python_version>='3.0' # LGPLv2.1
-bandit>=1.4.0 # Apache-2.0
+bandit!=1.6.0,>=1.4.0 # Apache-2.0
 coverage!=4.4,>=4.0 # Apache-2.0
 doc8>=0.6.0 # Apache-2.0
 flake8-import-order==0.12 # LGPLv3