diff --git a/tox.ini b/tox.ini
index b89285d..f262d81 100644
--- a/tox.ini
+++ b/tox.ini
@@ -10,31 +10,42 @@ deps =
     pytest-cov
     toml
 commands =
-    pytest --cov tox_poetry_installer --cov-config {toxinidir}/.coveragerc tests/ --cov-report term-missing
+    pytest --cov {envsitepackagesdir}/tox_poetry_installer --cov-config {toxinidir}/.coveragerc --cov-report term-missing tests/
 
 [testenv:static]
 description = Static formatting and quality enforcement
-require_locked_deps = true
 basepython = python3.8
+platform = linux
 ignore_errors = true
+require_locked_deps = true
 deps =
     pylint
     mypy
     black
     reorder-python-imports
     pre-commit
+allowlist_externals =
+    bash
 commands =
-    black {toxinidir}/tox_poetry_installer.py
-    reorder-python-imports {toxinidir}/tox_poetry_installer.py
+    black {toxinidir}/tox_poetry_installer/
+    # Oh man this is a doozy. If submodules are ever added to this plugin this will break, but I'm
+    # frustrated enough at this point that I'll need to take another look at it later to fix that.
+    # reorder-python-imports doesn't support handling directories on the CLI
+    # (https://github.com/asottile/reorder_python_imports/pull/76) and because the command is
+    # invoked directly (see comment below) we need file globbing to work around it.
+    # The "--unclassifiable-application-module" is a work around for reorder-python-imports not
+    # properly detecting the top-level module when run in a bash-wrapped command like this.
+    bash -c "reorder-python-imports {toxinidir}/tox_poetry_installer/*.py --unclassifiable-application-module tox_poetry_installer"
     pre-commit run --all-files
-    pylint --rcfile {toxinidir}/.pylintrc {toxinidir}/tox_poetry_installer.py
-    mypy --ignore-missing-imports --no-strict-optional {toxinidir}/tox_poetry_installer.py
+    pylint --rcfile {toxinidir}/.pylintrc {toxinidir}/tox_poetry_installer/
+    mypy --ignore-missing-imports --no-strict-optional {toxinidir}/tox_poetry_installer/
 
 [testenv:static-tests]
 description = Static formatting and quality enforcement for the tests
-require_locked_deps = true
 basepython = python3.8
+platform = linux
 ingore_errors = true
+require_locked_deps = true
 deps =
     pylint
     mypy
@@ -44,23 +55,26 @@ allowlist_externals =
     bash
 commands =
     black {toxinidir}/tests/
+    # These bash-wrapped commands hurt my face, but these tools expect directories to be valid
+    # python modules, which the "tests/" directory is not. Since tox calls all commands directly
+    # (which is good) file globbing doesn't work. To make file globbing work they need to be wrapped
+    # in a bash call (which is bad).
     bash -c "reorder-python-imports {toxinidir}/tests/*.py --unclassifiable-application-module tox_poetry_installer"
     bash -c "pylint --rcfile {toxinidir}/.pylintrc {toxinidir}/tests/*.py"
     bash -c "mypy --ignore-missing-imports --no-strict-optional {toxinidir}/tests/*.py"
 
 [testenv:security]
 description = Security checks
-require_locked_deps = true
 basepython = python3.8
-ignore_errors = true
-skip_install = true
+platform = linux
+ingore_errors = true
+require_locked_deps = true
 deps =
     bandit
     safety
     poetry
-allowlist_externals =
-    bash
 commands =
-    bandit --quiet {toxinidir}/tox_poetry_installer.py
-    bash -c "bandit --quiet --skip B101 {toxinidir}/tests/*.py"
-    bash -c "poetry export --format requirements.txt --without-hashes --dev | safety check --stdin --bare"
+    bandit --recursive --quiet {toxinidir}/tox_poetry_installer/
+    bandit --recursive --quiet --skip B101 {toxinidir}/tests/
+    poetry export --format requirements.txt --output {envtmpdir}/requirements.txt --without-hashes --dev
+    safety check --bare --file {envtmpdir}/requirements.txt