diff --git a/requirements-build.txt b/requirements-build.txt
index 8e5b9d9a..47d1bf7f 100644
--- a/requirements-build.txt
+++ b/requirements-build.txt
@@ -1,4 +1,4 @@
 # The build and tox versions specified here are also used as constraints
 # during CI and CD Github workflows
 build==0.9.0
-tox==3.28.0
+tox==4.1.2
diff --git a/tox.ini b/tox.ini
index d61df939..0491f867 100644
--- a/tox.ini
+++ b/tox.ini
@@ -27,6 +27,9 @@ deps =
 
 install_command = python3 -m pip install {opts} {packages}
 
+# Workaround https://github.com/tox-dev/tox/issues/2801 (python3 not allowed in Windows)
+allowlist_externals = python3
+
 # Develop test env to run tests against securesystemslib's master branch
 # Must to be invoked explicitly with, e.g. `tox -e with-sslib-master`
 [testenv:with-sslib-master]