diff --git a/tox.ini b/tox.ini
index 96671721886..9d81dc1d869 100644
--- a/tox.ini
+++ b/tox.ini
@@ -20,6 +20,17 @@ setenv =
    PYTHONDONTWRITEBYTECODE=1
 # TODO(stephenfin): Remove once we bump our upper-constraint to SQLAlchemy 2.0
    SQLALCHEMY_WARN_20=1
+# NOTE: Do not move the constraints from the install_command into deps, as that
+#       may result in tox using unconstrained/untested dependencies.
+#       We use "usedevelop = True" for tox jobs (except bindep), so tox does 2
+#       install calls, one for the deps and another for the cinder source code
+#       as editable (pip -e).
+#       Without the constraints in the install_command only the first
+#       installation will honor the upper constraints, and the second install
+#       for cinder itself will not know about the constraints which can result
+#       in installing versions we don't want.
+#       With constraints in the install_command tox will always honor our
+#       constraints.
 install_command =
   python -m pip install -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master} {opts} {packages}
 deps =