diff --git a/.pep8 b/.pep8
index f93712a..46b1cc3 100644
--- a/.pep8
+++ b/.pep8
@@ -1,2 +1,2 @@
-[pep8]
+[pycodestyle]
 ignore=E501
diff --git a/MANIFEST.in b/MANIFEST.in
new file mode 100644
index 0000000..073de4e
--- /dev/null
+++ b/MANIFEST.in
@@ -0,0 +1,4 @@
+include LICENSE
+include README.rst
+include requirements/base.in
+recursive-include ccx_keys *.html *.png *.gif *js *.css *jpg *jpeg *svg *py
diff --git a/Makefile b/Makefile
index 0e2e1c9..647b7a6 100644
--- a/Makefile
+++ b/Makefile
@@ -1,16 +1,26 @@
 .DEFAULT_GOAL := test
 
-.PHONY: html_coverage, quality, requirements
+.PHONY: html_coverage quality requirements test upgrade
 
 html_coverage:
 	coverage html && open htmlcov/index.html
 
 quality:
-	pep8 --config=.pep8 ccx_keys
+	pycodestyle --config=.pep8 ccx_keys
 	pylint --rcfile=pylintrc ccx_keys
 
-requirements:
-	pip install -r requirements.txt
+requirements: ## install development environment requirements
+	pip install -qr requirements/pip-tools.txt
+	pip-sync requirements/dev.txt requirements/private.*
 
 test:
 	tox
+
+upgrade: export CUSTOM_COMPILE_COMMAND=make upgrade
+upgrade: ## update the requirements/*.txt files with the latest packages satisfying requirements/*.in
+	pip install -qr requirements/pip-tools.txt
+	pip-compile --rebuild --upgrade -o requirements/pip-tools.txt requirements/pip-tools.in
+	pip-compile --rebuild --upgrade -o requirements/base.txt requirements/base.in
+	pip-compile --rebuild --upgrade -o requirements/test.txt requirements/test.in
+	pip-compile --rebuild --upgrade -o requirements/travis.txt requirements/travis.in
+	pip-compile --rebuild --upgrade -o requirements/dev.txt requirements/dev.in
diff --git a/ccx_keys/locator.py b/ccx_keys/locator.py
index 5380442..3b04c3c 100644
--- a/ccx_keys/locator.py
+++ b/ccx_keys/locator.py
@@ -1,5 +1,7 @@
 # -*- coding: utf-8 -*-
 """ Locator module. """
+from __future__ import unicode_literals
+
 import re
 
 from opaque_keys import InvalidKeyError
diff --git a/openedx.yaml b/openedx.yaml
index 16da1cd..d1cf1e6 100644
--- a/openedx.yaml
+++ b/openedx.yaml
@@ -1,6 +1,6 @@
 oeps:
     oep-7: true
-    oep-18: false
+    oep-18: true
 
 tags:
     - library
diff --git a/requirements.txt b/requirements.txt
deleted file mode 100644
index a08aa08..0000000
--- a/requirements.txt
+++ /dev/null
@@ -1,2 +0,0 @@
--e .
--r test-requirements.txt
diff --git a/requirements/base.in b/requirements/base.in
new file mode 100644
index 0000000..23661b0
--- /dev/null
+++ b/requirements/base.in
@@ -0,0 +1,5 @@
+# Core requirements for using this application
+-c constraints.txt
+
+edx-opaque-keys>=2.0.0
+six>=1.10.0
diff --git a/requirements/base.txt b/requirements/base.txt
new file mode 100644
index 0000000..730832c
--- /dev/null
+++ b/requirements/base.txt
@@ -0,0 +1,11 @@
+#
+# This file is autogenerated by pip-compile
+# To update, run:
+#
+#    make upgrade
+#
+edx-opaque-keys==2.0.1    # via -r requirements/base.in
+pbr==5.4.4                # via stevedore
+pymongo==3.10.1           # via edx-opaque-keys
+six==1.14.0               # via -r requirements/base.in, edx-opaque-keys, stevedore
+stevedore==1.32.0         # via edx-opaque-keys
diff --git a/requirements/constraints.txt b/requirements/constraints.txt
new file mode 100644
index 0000000..4d1b72e
--- /dev/null
+++ b/requirements/constraints.txt
@@ -0,0 +1,12 @@
+# Version constraints for pip-installation.
+#
+# This file doesn't install any packages. It specifies version constraints
+# that will be applied if a package is needed.
+#
+# When pinning something here, please provide an explanation of why.  Ideally,
+# link to other information that will help people in the future to remove the
+# pin when possible.  Writing an issue against the offending project and
+# linking to it here is good.
+
+# These packages are backports which can only be installed on Python 2.7
+futures ; python_version == "2.7"
diff --git a/requirements/dev.in b/requirements/dev.in
new file mode 100644
index 0000000..ce6365f
--- /dev/null
+++ b/requirements/dev.in
@@ -0,0 +1,8 @@
+# Additional requirements for development of this template
+-c constraints.txt
+
+-r pip-tools.txt          # pip-tools and its dependencies, for managing requirements files
+-r test.txt               # Dependencies for testing and quality checks
+-r travis.txt             # tox and associated dependencies
+
+tox-battery               # Makes tox aware of requirements file changes
diff --git a/requirements/dev.txt b/requirements/dev.txt
new file mode 100644
index 0000000..e3561a9
--- /dev/null
+++ b/requirements/dev.txt
@@ -0,0 +1,53 @@
+#
+# This file is autogenerated by pip-compile
+# To update, run:
+#
+#    make upgrade
+#
+appdirs==1.4.3            # via -r requirements/test.txt, -r requirements/travis.txt, virtualenv
+astroid==1.6.6            # via -r requirements/test.txt, pylint, pylint-celery
+backports.functools-lru-cache==1.6.1  # via -r requirements/test.txt, astroid, isort, pylint
+click-log==0.3.2          # via -r requirements/test.txt, edx-lint
+click==7.1.1              # via -r requirements/pip-tools.txt, -r requirements/test.txt, click-log, edx-lint, pip-tools
+configparser==4.0.2       # via -r requirements/test.txt, -r requirements/travis.txt, importlib-metadata, pylint
+contextlib2==0.6.0.post1  # via -r requirements/test.txt, -r requirements/travis.txt, importlib-metadata, importlib-resources, virtualenv, zipp
+coverage==5.0.4           # via -r requirements/test.txt
+ddt==1.3.1                # via -r requirements/test.txt
+distlib==0.3.0            # via -r requirements/test.txt, -r requirements/travis.txt, virtualenv
+edx-lint==1.4.1           # via -r requirements/test.txt
+edx-opaque-keys==2.0.1    # via -r requirements/test.txt
+enum34==1.1.10            # via -r requirements/test.txt, astroid
+filelock==3.0.12          # via -r requirements/test.txt, -r requirements/travis.txt, tox, virtualenv
+funcsigs==1.0.2           # via -r requirements/test.txt, mock
+futures==3.3.0 ; python_version == "2.7"  # via -c requirements/constraints.txt, -r requirements/test.txt, isort
+importlib-metadata==1.5.0  # via -r requirements/test.txt, -r requirements/travis.txt, importlib-resources, pluggy, tox, virtualenv
+importlib-resources==1.3.1  # via -r requirements/test.txt, -r requirements/travis.txt, virtualenv
+isort==4.3.21             # via -r requirements/test.txt, pylint
+lazy-object-proxy==1.4.3  # via -r requirements/test.txt, astroid
+mccabe==0.6.1             # via -r requirements/test.txt, pylint
+mock==3.0.5               # via -r requirements/test.txt
+nose==1.3.7               # via -r requirements/test.txt
+packaging==20.3           # via -r requirements/test.txt, -r requirements/travis.txt, tox
+pathlib2==2.3.5           # via -r requirements/test.txt, -r requirements/travis.txt, importlib-metadata, importlib-resources, virtualenv
+pbr==5.4.4                # via -r requirements/test.txt, stevedore
+pip-tools==4.5.1          # via -r requirements/pip-tools.txt
+pluggy==0.13.1            # via -r requirements/test.txt, -r requirements/travis.txt, tox
+py==1.8.1                 # via -r requirements/test.txt, -r requirements/travis.txt, tox
+pycodestyle==2.5.0        # via -r requirements/test.txt
+pylint-celery==0.3        # via -r requirements/test.txt, edx-lint
+pylint-django==0.11.1     # via -r requirements/test.txt, edx-lint
+pylint-plugin-utils==0.6  # via -r requirements/test.txt, pylint-celery, pylint-django
+pylint==1.9.5             # via -r requirements/test.txt, edx-lint, pylint-celery, pylint-django, pylint-plugin-utils
+pymongo==3.10.1           # via -r requirements/test.txt, edx-opaque-keys
+pyparsing==2.4.6          # via -r requirements/test.txt, -r requirements/travis.txt, packaging
+scandir==1.10.0           # via -r requirements/test.txt, -r requirements/travis.txt, pathlib2
+singledispatch==3.4.0.3   # via -r requirements/test.txt, -r requirements/travis.txt, astroid, importlib-resources, pylint
+six==1.14.0               # via -r requirements/pip-tools.txt, -r requirements/test.txt, -r requirements/travis.txt, astroid, edx-lint, edx-opaque-keys, mock, packaging, pathlib2, pip-tools, pylint, singledispatch, stevedore, tox, virtualenv
+stevedore==1.32.0         # via -r requirements/test.txt, edx-opaque-keys
+toml==0.10.0              # via -r requirements/test.txt, -r requirements/travis.txt, tox
+tox-battery==0.5.2        # via -r requirements/dev.in
+tox==3.14.5               # via -r requirements/test.txt, -r requirements/travis.txt, tox-battery
+typing==3.7.4.1           # via -r requirements/test.txt, -r requirements/travis.txt, importlib-resources
+virtualenv==20.0.10       # via -r requirements/test.txt, -r requirements/travis.txt, tox
+wrapt==1.12.1             # via -r requirements/test.txt, astroid
+zipp==1.2.0               # via -r requirements/test.txt, -r requirements/travis.txt, importlib-metadata, importlib-resources
diff --git a/requirements/pip-tools.in b/requirements/pip-tools.in
new file mode 100644
index 0000000..3f1b64a
--- /dev/null
+++ b/requirements/pip-tools.in
@@ -0,0 +1,4 @@
+# Just the dependencies to run pip-tools, mainly for the "upgrade" make target
+-c constraints.txt
+
+pip-tools                 # Contains pip-compile, used to generate pip requirements files
diff --git a/requirements/pip-tools.txt b/requirements/pip-tools.txt
new file mode 100644
index 0000000..a99fe20
--- /dev/null
+++ b/requirements/pip-tools.txt
@@ -0,0 +1,9 @@
+#
+# This file is autogenerated by pip-compile
+# To update, run:
+#
+#    make upgrade
+#
+click==7.1.1              # via pip-tools
+pip-tools==4.5.1          # via -r requirements/pip-tools.in
+six==1.14.0               # via pip-tools
diff --git a/requirements/private.readme b/requirements/private.readme
new file mode 100644
index 0000000..5600a10
--- /dev/null
+++ b/requirements/private.readme
@@ -0,0 +1,15 @@
+# If there are any Python packages you want to keep in your virtualenv beyond
+# those listed in the official requirements files, create a "private.in" file
+# and list them there.  Generate the corresponding "private.txt" file pinning
+# all of their indirect dependencies to specific versions as follows:
+
+#     pip-compile private.in
+
+# This allows you to use "pip-sync" without removing these packages:
+
+#     pip-sync requirements/*.txt
+
+# "private.in" and "private.txt" aren't checked into git to avoid merge
+# conflicts, and the presence of this file allows "private.*" to be
+# included in scripted pip-sync usage without requiring that those files be
+# created first.
diff --git a/requirements/test.in b/requirements/test.in
new file mode 100644
index 0000000..a4a5c64
--- /dev/null
+++ b/requirements/test.in
@@ -0,0 +1,13 @@
+# Requirements for test runs
+-c constraints.txt
+
+-r base.txt               # Core dependencies
+
+coverage>=4.0.3
+ddt>=1.0.1
+lazy-object-proxy
+edx-lint>=0.4.0
+mock>=1.3.0
+nose>=1.3.7
+pycodestyle>=1.7.0
+tox>=2.3.1
diff --git a/requirements/test.txt b/requirements/test.txt
new file mode 100644
index 0000000..5bd319f
--- /dev/null
+++ b/requirements/test.txt
@@ -0,0 +1,51 @@
+#
+# This file is autogenerated by pip-compile
+# To update, run:
+#
+#    make upgrade
+#
+appdirs==1.4.3            # via virtualenv
+astroid==1.6.6            # via pylint, pylint-celery
+backports.functools-lru-cache==1.6.1  # via astroid, isort, pylint
+click-log==0.3.2          # via edx-lint
+click==7.1.1              # via click-log, edx-lint
+configparser==4.0.2       # via importlib-metadata, pylint
+contextlib2==0.6.0.post1  # via importlib-metadata, importlib-resources, virtualenv, zipp
+coverage==5.0.4           # via -r requirements/test.in
+ddt==1.3.1                # via -r requirements/test.in
+distlib==0.3.0            # via virtualenv
+edx-lint==1.4.1           # via -r requirements/test.in
+edx-opaque-keys==2.0.1    # via -r requirements/base.txt
+enum34==1.1.10            # via astroid
+filelock==3.0.12          # via tox, virtualenv
+funcsigs==1.0.2           # via mock
+futures==3.3.0 ; python_version == "2.7"  # via -c requirements/constraints.txt, isort
+importlib-metadata==1.5.0  # via importlib-resources, pluggy, tox, virtualenv
+importlib-resources==1.3.1  # via virtualenv
+isort==4.3.21             # via pylint
+lazy-object-proxy==1.4.3  # via -r requirements/test.in, astroid
+mccabe==0.6.1             # via pylint
+mock==3.0.5               # via -r requirements/test.in
+nose==1.3.7               # via -r requirements/test.in
+packaging==20.3           # via tox
+pathlib2==2.3.5           # via importlib-metadata, importlib-resources, virtualenv
+pbr==5.4.4                # via -r requirements/base.txt, stevedore
+pluggy==0.13.1            # via tox
+py==1.8.1                 # via tox
+pycodestyle==2.5.0        # via -r requirements/test.in
+pylint-celery==0.3        # via edx-lint
+pylint-django==0.11.1     # via edx-lint
+pylint-plugin-utils==0.6  # via pylint-celery, pylint-django
+pylint==1.9.5             # via edx-lint, pylint-celery, pylint-django, pylint-plugin-utils
+pymongo==3.10.1           # via -r requirements/base.txt, edx-opaque-keys
+pyparsing==2.4.6          # via packaging
+scandir==1.10.0           # via pathlib2
+singledispatch==3.4.0.3   # via astroid, importlib-resources, pylint
+six==1.14.0               # via -r requirements/base.txt, astroid, edx-lint, edx-opaque-keys, mock, packaging, pathlib2, pylint, singledispatch, stevedore, tox, virtualenv
+stevedore==1.32.0         # via -r requirements/base.txt, edx-opaque-keys
+toml==0.10.0              # via tox
+tox==3.14.5               # via -r requirements/test.in
+typing==3.7.4.1           # via importlib-resources
+virtualenv==20.0.10       # via tox
+wrapt==1.12.1             # via astroid
+zipp==1.2.0               # via importlib-metadata, importlib-resources
diff --git a/requirements/travis.in b/requirements/travis.in
new file mode 100644
index 0000000..cac9426
--- /dev/null
+++ b/requirements/travis.in
@@ -0,0 +1,4 @@
+# Requirements for running tests in Travis
+-c constraints.txt
+
+tox                       # Virtualenv management for tests
diff --git a/requirements/travis.txt b/requirements/travis.txt
new file mode 100644
index 0000000..320779b
--- /dev/null
+++ b/requirements/travis.txt
@@ -0,0 +1,26 @@
+#
+# This file is autogenerated by pip-compile
+# To update, run:
+#
+#    make upgrade
+#
+appdirs==1.4.3            # via virtualenv
+configparser==4.0.2       # via importlib-metadata
+contextlib2==0.6.0.post1  # via importlib-metadata, importlib-resources, virtualenv, zipp
+distlib==0.3.0            # via virtualenv
+filelock==3.0.12          # via tox, virtualenv
+importlib-metadata==1.5.0  # via importlib-resources, pluggy, tox, virtualenv
+importlib-resources==1.3.1  # via virtualenv
+packaging==20.3           # via tox
+pathlib2==2.3.5           # via importlib-metadata, importlib-resources, virtualenv
+pluggy==0.13.1            # via tox
+py==1.8.1                 # via tox
+pyparsing==2.4.6          # via packaging
+scandir==1.10.0           # via pathlib2
+singledispatch==3.4.0.3   # via importlib-resources
+six==1.14.0               # via packaging, pathlib2, tox, virtualenv
+toml==0.10.0              # via tox
+tox==3.14.5               # via -r requirements/travis.in
+typing==3.7.4.1           # via importlib-resources
+virtualenv==20.0.10       # via tox
+zipp==1.2.0               # via importlib-metadata, importlib-resources
diff --git a/setup.py b/setup.py
index c4bb655..3fb6d3f 100644
--- a/setup.py
+++ b/setup.py
@@ -1,5 +1,38 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+"""
+Package metadata for edx-ccx-keys.
+"""
+from io import open
+
 from setuptools import setup
 
+def load_requirements(*requirements_paths):
+    """
+    Load all requirements from the specified requirements files.
+
+    Returns:
+        list: Requirements file relative path strings
+    """
+    requirements = set()
+    for path in requirements_paths:
+        with open(path) as reqs:
+            requirements.update(
+                line.split('#')[0].strip() for line in reqs
+                if is_requirement(line.strip())
+            )
+    return list(requirements)
+
+
+def is_requirement(line):
+    """
+    Return True if the requirement line is a package requirement.
+
+    Returns:
+        bool: True if the line is not blank, a comment, a URL, or an included file
+    """
+    return line and not line.startswith(('-r', '#', '-e', 'git+', '-c'))
+
 setup(
     name='edx-ccx-keys',
     version='1.0.0',
@@ -23,10 +56,7 @@
     packages=[
         'ccx_keys',
     ],
-    install_requires=[
-        'edx-opaque-keys>=2.0.0,<3.0.0',
-        'six>=1.10.0,<2.0.0'
-    ],
+    install_requires=load_requirements('requirements/base.in'),
     entry_points={
         'context_key': [
             'ccx-v1 = ccx_keys.locator:CCXLocator',
diff --git a/test-requirements.txt b/test-requirements.txt
deleted file mode 100644
index 5416bf8..0000000
--- a/test-requirements.txt
+++ /dev/null
@@ -1,8 +0,0 @@
-coverage>=4.0.3,<5.0.0
-ddt>=1.0.1,<2.0.0
-lazy-object-proxy<1.4.1
-edx-lint>=0.4.0,<1.0.0
-mock>=1.3.0,<2.0.0
-nose>=1.3.7,<2.0.0
-pep8>=1.7.0,<2.0.0
-tox>=2.3.1,<3.0.0
diff --git a/tox.ini b/tox.ini
index a2d6a32..356974a 100644
--- a/tox.ini
+++ b/tox.ini
@@ -3,7 +3,7 @@ envlist = py27,py35
 
 [testenv]
 deps =
-    -rtest-requirements.txt
+    -r{toxinidir}/requirements/test.txt
 
 commands =
     coverage run -m nose