diff --git a/certbot-nginx/setup.py b/certbot-nginx/setup.py
index 80c473d5c..2a15ed1d3 100644
--- a/certbot-nginx/setup.py
+++ b/certbot-nginx/setup.py
@@ -13,7 +13,7 @@ install_requires = [
     'acme>=1.4.0',
     'certbot>=1.6.0',
     'PyOpenSSL>=17.3.0',
-    'pyparsing>=1.5.5',  # Python3 support
+    'pyparsing>=2.2.0',
     'setuptools>=39.0.1',
     'zope.interface',
 ]
diff --git a/tools/oldest_constraints.txt b/tools/oldest_constraints.txt
index 9ae57b649..7ba1592ba 100644
--- a/tools/oldest_constraints.txt
+++ b/tools/oldest_constraints.txt
@@ -3,7 +3,7 @@
 # the versions included in the various Linux distros where we are packaged.
 
 # CentOS/RHEL 7 EPEL constraints
-cffi==1.6.0
+cffi==1.9.1
 chardet==2.2.1
 configobj==4.7.2
 ipaddress==1.0.16
@@ -30,18 +30,17 @@ PyICU==1.8
 colorama==0.3.2
 enum34==1.0.3
 html5lib==0.999
-idna==2.0
 pbr==1.8.0
 pytz==2012rc0
 
 # Debian Buster constraints
 google-api-python-client==1.5.5
+pyparsing==2.2.0
 
 # Our setup.py constraints
 apacheconfig==0.3.2
 cloudflare==1.5.1
 parsedatetime==1.3
-pyparsing==1.5.5
 python-digitalocean==1.11
 requests[security]==2.6.0
 
@@ -57,6 +56,7 @@ distro==1.0.1
 # using their local-oldest-requirements.txt
 dns-lexicon==2.2.1
 httplib2==0.9.2
+idna==2.6
 setuptools==39.0.1
 
 # Plugin constraints