diff --git a/.azure-pipelines/templates/jobs/packaging-jobs.yml b/.azure-pipelines/templates/jobs/packaging-jobs.yml
index 22f0f3790..d26f1d4d6 100644
--- a/.azure-pipelines/templates/jobs/packaging-jobs.yml
+++ b/.azure-pipelines/templates/jobs/packaging-jobs.yml
@@ -186,7 +186,7 @@ jobs:
         displayName: Install Certbot snap
       - script: |
           set -e
-          venv/bin/python -m tox -e integration-external,apacheconftest-external-with-pebble
+          venv/bin/python -m tox run -e integration-external,apacheconftest-external-with-pebble
         displayName: Run tox
   - job: snap_dns_run
     dependsOn: snaps_build
diff --git a/certbot/docs/contributing.rst b/certbot/docs/contributing.rst
index 1a6c402af..8a7ca935e 100644
--- a/certbot/docs/contributing.rst
+++ b/certbot/docs/contributing.rst
@@ -134,7 +134,7 @@ For debugging, we recommend putting
 
 Once you are done with your code changes, and the tests in ``foo_test.py``
 pass, run all of the unit tests for Certbot and check for coverage with ``tox
--e cover``. You should then check for code style with ``tox -e lint`` (all
+-e cover``. You should then check for code style with ``tox run -e lint`` (all
 files) or ``pylint --rcfile=.pylintrc path/to/file.py`` (single file at a
 time).
 
@@ -163,7 +163,7 @@ With a user allowed to access your local Docker daemon, run:
 
 .. code-block:: shell
 
-  tox -e integration
+  tox run -e integration
 
 Tests will be run using pytest. A test report and a code coverage report will be
 displayed at the end of the integration tests execution.
@@ -485,7 +485,7 @@ annotations; we can find bugs in Certbot even without a fully annotated codebase
 Zulip wrote a `great guide`_ to using mypy. It’s useful, but you don’t have to read the whole thing
 to start contributing to Certbot.
 
-To run mypy on Certbot, use ``tox -e mypy`` on a machine that has Python 3 installed.
+To run mypy on Certbot, use ``tox run -e mypy`` on a machine that has Python 3 installed.
 
 Also note that OpenSSL, which we rely on, has type definitions for crypto but not SSL. We use both.
 Those imports should look like this:
@@ -509,12 +509,12 @@ Steps:
    something we have the time and interest to review.
 1. Write your code! When doing this, you should add :ref:`mypy type annotations
    <type annotations>` for any functions you add or modify. You can check that
-   you've done this correctly by running ``tox -e mypy`` on a machine that has
+   you've done this correctly by running ``tox run -e mypy`` on a machine that has
    Python 3 installed.
 2. Make sure your environment is set up properly and that you're in your
    virtualenv. You can do this by following the instructions in the
    :ref:`Getting Started <getting_started>` section.
-3. Run ``tox -e lint`` to check for pylint errors. Fix any errors.
+3. Run ``tox run -e lint`` to check for pylint errors. Fix any errors.
 4. Run ``tox --skip-missing-interpreters`` to run all the tests we recommend
    developers run locally. The ``--skip-missing-interpreters`` argument ignores
    missing versions of Python needed for running the tests. Fix any errors.
diff --git a/tox.ini b/tox.ini
index 8178771d4..cc83114c6 100644
--- a/tox.ini
+++ b/tox.ini
@@ -38,7 +38,7 @@ deps =
     -e certbot-dns-route53
     -e certbot-dns-sakuracloud
     -e certbot-nginx
-whitelist_externals =
+allowlist_externals =
     echo
     false
 # This and the next few testenvs are a workaround for
@@ -205,7 +205,7 @@ commands =
     docker build -t certbot-compatibility-test -f certbot-compatibility-test/Dockerfile .
     docker build -t apache-compat -f certbot-compatibility-test/Dockerfile-apache .
     docker run --rm -t apache-compat -c apache.tar.gz -vvvv
-whitelist_externals =
+allowlist_externals =
     docker
 passenv =
     DOCKER_*
@@ -216,7 +216,7 @@ commands =
     docker build -t certbot-compatibility-test -f certbot-compatibility-test/Dockerfile .
     docker build -t nginx-compat -f certbot-compatibility-test/Dockerfile-nginx .
     docker run --rm -t nginx-compat -c nginx.tar.gz -vv -aie
-whitelist_externals =
+allowlist_externals =
     docker
 passenv =
     DOCKER_*