diff --git a/tox.ini b/tox.ini
index faaf037c..b8e564ec 100644
--- a/tox.ini
+++ b/tox.ini
@@ -88,7 +88,10 @@ commands =
 deps=
    -r{toxinidir}/requirements.txt
    -r{toxinidir}/dev-requirements.txt
+# Last supported cryptography version that can link against
+# OpenSSL v1.0.2 (which pypy35 uses) is 3.1.1
 commands =
+    pip install --upgrade cryptography==3.1.1
     python setup.py compile_catalog
     coverage run --parallel -m pytest {posargs}
     flake8 . --count --show-source --statistics