diff --git a/.evergreen/config.yml b/.evergreen/config.yml
index 523ed5f91..36425610e 100644
--- a/.evergreen/config.yml
+++ b/.evergreen/config.yml
@@ -74,7 +74,7 @@ functions:
               export PROJECT_DIRECTORY="$PROJECT_DIRECTORY"
 
               export TMPDIR="$MONGO_ORCHESTRATION_HOME/db"
-              export PATH="$MONGODB_BINARIES:$PATH"
+              export PATH="$MONGODB_BINARIES:/home/admin/.cargo/bin:$PATH"
               export PROJECT="${project}"
            EOT
            # See what we've done
diff --git a/.evergreen/run-atlas-tests.sh b/.evergreen/run-atlas-tests.sh
index 0927f2697..61d044045 100644
--- a/.evergreen/run-atlas-tests.sh
+++ b/.evergreen/run-atlas-tests.sh
@@ -35,7 +35,7 @@ else
     IS_PRE_279=$(python -c "import sys; sys.stdout.write('1' if sys.version_info < (2, 7, 9) else '0')")
     if [ $IS_PRE_279 = "1" ]; then
         echo "Using a Pre-2.7.9 CPython"
-        python -m pip install pyopenssl>=17.2.0 service_identity>18.1.0
+        python -m pip install -r .evergreen/test-pyopenssl-requirements.txt
     else
         echo "Using CPython 2.7.9+"
     fi
diff --git a/.evergreen/run-ocsp-tests.sh b/.evergreen/run-ocsp-tests.sh
index 75fba7e2c..8b7b33da0 100644
--- a/.evergreen/run-ocsp-tests.sh
+++ b/.evergreen/run-ocsp-tests.sh
@@ -20,6 +20,6 @@ fi
 createvirtualenv $PYTHON ocsptest
 trap "deactivate; rm -rf ocsptest" EXIT HUP
 
-python -m pip install --prefer-binary pyopenssl requests service_identity
+python -m pip install --prefer-binary -r .evergreen/test-pyopenssl-requirements.txt
 
 OCSP_TLS_SHOULD_SUCCEED=${OCSP_TLS_SHOULD_SUCCEED} CA_FILE=${CA_FILE} python test/ocsp/test_ocsp.py
diff --git a/.evergreen/run-tests.sh b/.evergreen/run-tests.sh
index b456a93c8..c40c28918 100755
--- a/.evergreen/run-tests.sh
+++ b/.evergreen/run-tests.sh
@@ -75,7 +75,7 @@ if [ -z "$PYTHON_BINARY" ]; then
             exit 1
         fi
     else
-        $VIRTUALENV pymongotestvenv
+        $VIRTUALENV --never-download pymongotestvenv
         . pymongotestvenv/bin/activate
         PYTHON=python
         trap "deactivate; rm -rf pymongotestvenv" EXIT HUP
@@ -114,7 +114,7 @@ if [ -n "$TEST_PYOPENSSL" ]; then
     trap "deactivate; rm -rf pyopenssltest" EXIT HUP
     PYTHON=python
 
-    python -m pip install --prefer-binary pyopenssl requests service_identity
+    python -m pip install --prefer-binary -r .evergreen/test-pyopenssl-requirements.txt
 fi
 
 if [ -n "$TEST_ENCRYPTION" ]; then
diff --git a/.evergreen/test-encryption-requirements.txt b/.evergreen/test-encryption-requirements.txt
index 72faca36c..743137a6b 100644
--- a/.evergreen/test-encryption-requirements.txt
+++ b/.evergreen/test-encryption-requirements.txt
@@ -1,6 +1,9 @@
 # cffi==1.14.3 was the last installable release on RHEL 6.2 with Python 3.4
 cffi==1.14.3;python_version=="3.4"
 cffi>=1.12.0,<2;python_version!="3.4"
-cryptography>=2
+cryptography>=2,<3.4;python_version=="2.7"
+cryptography>=2,<2.9;python_version=="3.4"
+cryptography>=2,<3.3;python_version=="3.5"
+cryptography>=2;python_version>"3.5"
 # boto3 is required by drivers-evergreen-tools/.evergreen/csfle/set-temp-creds.sh
 boto3<2
diff --git a/.evergreen/test-pyopenssl-requirements.txt b/.evergreen/test-pyopenssl-requirements.txt
new file mode 100644
index 000000000..2b9edaa60
--- /dev/null
+++ b/.evergreen/test-pyopenssl-requirements.txt
@@ -0,0 +1,8 @@
+-r test-encryption-requirements.txt
+pyopenssl>=17.2.0,<20;python_version=="3.4"
+pyopenssl>=17.2.0;python_version!="3.4"
+attrs<=20.3.0;python_version=="3.4"
+service-identity==18.1.0;python_version=="3.4"
+service-identity>=18.1.0;python_version!="3.4"
+requests<2.22;python_version=="3.4"
+requests<3.0;python_version!="3.4"