diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 4d2c6b159253..08b24d298574 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,16 +6,6 @@ updates:
   schedule:
     interval: "daily"
 
-- package-ecosystem: "pip"
-  directory: "/configs"
-  schedule:
-    interval: "daily"
-
-- package-ecosystem: "pip"
-  directory: "/test/extensions/filters/network/thrift_proxy"
-  schedule:
-    interval: "daily"
-
 - package-ecosystem: "pip"
   directory: "/examples/grpc-bridge/client"
   schedule:
diff --git a/WORKSPACE b/WORKSPACE
index 65b97f124d45..a96cba501302 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -16,10 +16,6 @@ load("//bazel:repositories_extra.bzl", "envoy_dependencies_extra")
 
 envoy_dependencies_extra()
 
-load("@base_pip3//:requirements.bzl", "install_deps")
-
-install_deps()
-
 load("//bazel:dependency_imports.bzl", "envoy_dependency_imports")
 
 envoy_dependency_imports()
diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
index 6a12830e3b2f..81b15344de49 100644
--- a/bazel/dependency_imports.bzl
+++ b/bazel/dependency_imports.bzl
@@ -9,6 +9,7 @@ load("@rules_rust//rust:repositories.bzl", "rust_repositories")
 load("@rules_antlr//antlr:deps.bzl", "antlr_dependencies")
 load("@proxy_wasm_rust_sdk//bazel:dependencies.bzl", "proxy_wasm_rust_sdk_dependencies")
 load("@rules_cc//cc:repositories.bzl", "rules_cc_dependencies", "rules_cc_toolchains")
+load("@base_pip3//:requirements.bzl", pip_dependencies = "install_deps")
 
 # go version for rules_go
 GO_VERSION = "1.17.5"
@@ -20,6 +21,7 @@ def envoy_dependency_imports(go_version = GO_VERSION):
     go_register_toolchains(go_version)
     gazelle_dependencies()
     apple_rules_dependencies()
+    pip_dependencies()
     rust_repositories()
     upb_deps()
     antlr_dependencies(472)
diff --git a/bazel/external/twitter_common_rpc.BUILD b/bazel/external/twitter_common_rpc.BUILD
deleted file mode 100644
index df79842360bd..000000000000
--- a/bazel/external/twitter_common_rpc.BUILD
+++ /dev/null
@@ -1,15 +0,0 @@
-load("@rules_python//python:defs.bzl", "py_library")
-
-licenses(["notice"])  # Apache 2
-
-py_library(
-    name = "twitter_common_rpc",
-    srcs = glob([
-        "twitter/**/*.py",
-    ]),
-    visibility = ["//visibility:public"],
-    deps = [
-        "@com_github_twitter_common_finagle_thrift//:twitter_common_finagle_thrift",
-        "@com_github_twitter_common_lang//:twitter_common_lang",
-    ],
-)
diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
index fc1f3023d163..d93827b8391c 100644
--- a/bazel/repositories.bzl
+++ b/bazel/repositories.bzl
@@ -100,22 +100,6 @@ def envoy_repo():
     if "envoy_repo" not in native.existing_rules().keys():
         _envoy_repo(name = "envoy_repo")
 
-# Python dependencies.
-def _python_deps():
-    # TODO(htuch): convert these to pip3_import.
-    external_http_archive(
-        name = "com_github_twitter_common_lang",
-        build_file = "@envoy//bazel/external:twitter_common_lang.BUILD",
-    )
-    external_http_archive(
-        name = "com_github_twitter_common_rpc",
-        build_file = "@envoy//bazel/external:twitter_common_rpc.BUILD",
-    )
-    external_http_archive(
-        name = "com_github_twitter_common_finagle_thrift",
-        build_file = "@envoy//bazel/external:twitter_common_finagle_thrift.BUILD",
-    )
-
 # Bazel native C++ dependencies. For the dependencies that doesn't provide autoconf/automake builds.
 def _cc_deps():
     external_http_archive("grpc_httpjson_transcoding")
@@ -236,7 +220,6 @@ def envoy_dependencies(skip_targets = []):
     # Unconditional, since we use this only for compiler-agnostic fuzzing utils.
     _org_llvm_releases_compiler_rt()
 
-    _python_deps()
     _cc_deps()
     _go_deps(skip_targets)
     _rust_deps()
diff --git a/bazel/repositories_extra.bzl b/bazel/repositories_extra.bzl
index 8729c9163ca9..3f35b4d1e86f 100644
--- a/bazel/repositories_extra.bzl
+++ b/bazel/repositories_extra.bzl
@@ -9,21 +9,13 @@ def _python_deps():
         requirements_lock = "@envoy//tools/base:requirements.txt",
         extra_pip_args = ["--require-hashes"],
     )
-    pip_install(
-        name = "configs_pip3",
-        requirements = "@envoy//configs:requirements.txt",
-        extra_pip_args = ["--require-hashes"],
-    )
+
+    # These need to use `pip_install`
     pip_install(
         # Note: dev requirements do *not* check hashes
         name = "dev_pip3",
         requirements = "@envoy//tools/dev:requirements.txt",
     )
-    pip_install(
-        name = "thrift_pip3",
-        requirements = "@envoy//test/extensions/filters/network/thrift_proxy:requirements.txt",
-        extra_pip_args = ["--require-hashes"],
-    )
     pip_install(
         name = "fuzzing_pip3",
         requirements = "@rules_fuzzing//fuzzing:requirements.txt",
diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
index a61b8ec46468..00eaa0285c45 100644
--- a/bazel/repository_locations.bzl
+++ b/bazel/repository_locations.bzl
@@ -589,39 +589,6 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         release_date = "2019-09-18",
         cpe = "N/A",
     ),
-    com_github_twitter_common_lang = dict(
-        project_name = "twitter.common.lang (Thrift)",
-        project_desc = "twitter.common Python language and compatibility facilities",
-        project_url = "https://pypi.org/project/twitter.common.lang",
-        version = "0.3.9",
-        sha256 = "56d1d266fd4767941d11c27061a57bc1266a3342e551bde3780f9e9eb5ad0ed1",
-        strip_prefix = "twitter.common.lang-{version}/src",
-        urls = ["https://files.pythonhosted.org/packages/08/bc/d6409a813a9dccd4920a6262eb6e5889e90381453a5f58938ba4cf1d9420/twitter.common.lang-{version}.tar.gz"],
-        release_date = "2016-10-17",
-        use_category = ["test_only"],
-    ),
-    com_github_twitter_common_rpc = dict(
-        project_name = "twitter.common.rpc (Thrift)",
-        project_desc = "twitter.common Thrift helpers including Finagle and SSL transports",
-        project_url = "https://pypi.org/project/twitter.common.rpc",
-        version = "0.3.9",
-        sha256 = "0792b63fb2fb32d970c2e9a409d3d00633190a22eb185145fe3d9067fdaa4514",
-        strip_prefix = "twitter.common.rpc-{version}/src",
-        urls = ["https://files.pythonhosted.org/packages/be/97/f5f701b703d0f25fbf148992cd58d55b4d08d3db785aad209255ee67e2d0/twitter.common.rpc-{version}.tar.gz"],
-        release_date = "2016-10-17",
-        use_category = ["test_only"],
-    ),
-    com_github_twitter_common_finagle_thrift = dict(
-        project_name = "twitter.common.finagle-thrift",
-        project_desc = "twitter.common Thrift stubs for Zipkin RPC tracing support in Finagle",
-        project_url = "https://pypi.org/project/twitter.common.finagle-thrift",
-        version = "0.3.9",
-        sha256 = "1e3a57d11f94f58745e6b83348ecd4fa74194618704f45444a15bc391fde497a",
-        strip_prefix = "twitter.common.finagle-thrift-{version}/src",
-        urls = ["https://files.pythonhosted.org/packages/f9/e7/4f80d582578f8489226370762d2cf6bc9381175d1929eba1754e03f70708/twitter.common.finagle-thrift-{version}.tar.gz"],
-        release_date = "2016-10-17",
-        use_category = ["test_only"],
-    ),
     com_google_googletest = dict(
         project_name = "Google Test",
         project_desc = "Google's C++ test framework",
diff --git a/configs/BUILD b/configs/BUILD
index 71e3fa5f9774..40f28600704a 100644
--- a/configs/BUILD
+++ b/configs/BUILD
@@ -3,7 +3,7 @@ load(
     "envoy_package",
 )
 load("@rules_python//python:defs.bzl", "py_binary")
-load("@configs_pip3//:requirements.bzl", "requirement")
+load("@base_pip3//:requirements.bzl", "requirement")
 
 licenses(["notice"])  # Apache 2
 
diff --git a/configs/requirements.txt b/configs/requirements.txt
deleted file mode 100644
index d0aaf38b7b60..000000000000
--- a/configs/requirements.txt
+++ /dev/null
@@ -1,38 +0,0 @@
-Jinja2==3.0.3 \
-    --hash=sha256:077ce6014f7b40d03b47d1f1ca4b0fc8328a692bd284016f806ed0eaca390ad8 \
-    --hash=sha256:611bb273cd68f3b993fabdc4064fc858c5b47a973cb5aa7999ec1ba405c87cd7
-MarkupSafe==2.0.1 \
-    --hash=sha256:f9081981fe268bd86831e5c75f7de206ef275defcb82bc70740ae6dc507aee51 \
-    --hash=sha256:0955295dd5eec6cb6cc2fe1698f4c6d84af2e92de33fbcac4111913cd100a6ff \
-    --hash=sha256:0446679737af14f45767963a1a9ef7620189912317d095f2d9ffa183a4d25d2b \
-    --hash=sha256:f826e31d18b516f653fe296d967d700fddad5901ae07c622bb3705955e1faa94 \
-    --hash=sha256:fa130dd50c57d53368c9d59395cb5526eda596d3ffe36666cd81a44d56e48872 \
-    --hash=sha256:905fec760bd2fa1388bb5b489ee8ee5f7291d692638ea5f67982d968366bef9f \
-    --hash=sha256:6c4ca60fa24e85fe25b912b01e62cb969d69a23a5d5867682dd3e80b5b02581d \
-    --hash=sha256:b2f4bf27480f5e5e8ce285a8c8fd176c0b03e93dcc6646477d4630e83440c6a9 \
-    --hash=sha256:0717a7390a68be14b8c793ba258e075c6f4ca819f15edfc2a3a027c823718567 \
-    --hash=sha256:6557b31b5e2c9ddf0de32a691f2312a32f77cd7681d8af66c2692efdbef84c18 \
-    --hash=sha256:49e3ceeabbfb9d66c3aef5af3a60cc43b85c33df25ce03d0031a608b0a8b2e3f \
-    --hash=sha256:d7f9850398e85aba693bb640262d3611788b1f29a79f0c93c565694658f4071f \
-    --hash=sha256:6a7fae0dd14cf60ad5ff42baa2e95727c3d81ded453457771d02b7d2b3f9c0c2 \
-    --hash=sha256:b7f2d075102dc8c794cbde1947378051c4e5180d52d276987b8d28a3bd58c17d \
-    --hash=sha256:a30e67a65b53ea0a5e62fe23682cfe22712e01f453b95233b25502f7c61cb415 \
-    --hash=sha256:611d1ad9a4288cf3e3c16014564df047fe08410e628f89805e475368bd304914 \
-    --hash=sha256:be98f628055368795d818ebf93da628541e10b75b41c559fdf36d104c5787066 \
-    --hash=sha256:1d609f577dc6e1aa17d746f8bd3c31aa4d258f4070d61b2aa5c4166c1539de35 \
-    --hash=sha256:7d91275b0245b1da4d4cfa07e0faedd5b0812efc15b702576d103293e252af1b \
-    --hash=sha256:01a9b8ea66f1658938f65b93a85ebe8bc016e6769611be228d797c9d998dd298 \
-    --hash=sha256:47ab1e7b91c098ab893b828deafa1203de86d0bc6ab587b160f78fe6c4011f75 \
-    --hash=sha256:97383d78eb34da7e1fa37dd273c20ad4320929af65d156e35a5e2d89566d9dfb \
-    --hash=sha256:023cb26ec21ece8dc3907c0e8320058b2e0cb3c55cf9564da612bc325bed5e64 \
-    --hash=sha256:984d76483eb32f1bcb536dc27e4ad56bba4baa70be32fa87152832cdd9db0833 \
-    --hash=sha256:2ef54abee730b502252bcdf31b10dacb0a416229b72c18b19e24a4509f273d26 \
-    --hash=sha256:3c112550557578c26af18a1ccc9e090bfe03832ae994343cfdacd287db6a6ae7 \
-    --hash=sha256:53edb4da6925ad13c07b6d26c2a852bd81e364f95301c66e930ab2aef5b5ddd8 \
-    --hash=sha256:f5653a225f31e113b152e56f154ccbe59eeb1c7487b39b9d9f9cdb58e6c79dc5 \
-    --hash=sha256:4efca8f86c54b22348a5467704e3fec767b2db12fc39c6d963168ab1d3fc9135 \
-    --hash=sha256:ab3ef638ace319fa26553db0624c4699e31a28bb2a835c5faca8f8acf6a5a902 \
-    --hash=sha256:f8ba0e8349a38d3001fae7eadded3f6606f0da5d748ee53cc1dab1d6527b9509 \
-    --hash=sha256:10f82115e21dc0dfec9ab5c0223652f7197feb168c940f3ef61563fc2d6beb74 \
-    --hash=sha256:693ce3f9e70a6cf7d2fb9e6c9d8b204b6b39897a2c4a1aa65728d5ac97dcc1d8 \
-    --hash=sha256:594c67807fb16238b30c44bdf74f36c02cdf22d1c8cda91ef8a0ed8dabf5620a
diff --git a/test/extensions/filters/network/thrift_proxy/driver/BUILD b/test/extensions/filters/network/thrift_proxy/driver/BUILD
index e27580ed82cd..102a6a1ca397 100644
--- a/test/extensions/filters/network/thrift_proxy/driver/BUILD
+++ b/test/extensions/filters/network/thrift_proxy/driver/BUILD
@@ -1,6 +1,6 @@
 load("@rules_python//python:defs.bzl", "py_binary")
 load("//bazel:envoy_build_system.bzl", "envoy_package")
-load("@thrift_pip3//:requirements.bzl", "requirement")
+load("@base_pip3//:requirements.bzl", "requirement")
 
 licenses(["notice"])  # Apache 2
 
@@ -23,7 +23,7 @@ py_binary(
         "//test/extensions/filters/network/thrift_proxy/driver/fbthrift:fbthrift_lib",
         "//test/extensions/filters/network/thrift_proxy/driver/finagle:finagle_lib",
         "//test/extensions/filters/network/thrift_proxy/driver/generated/example:example_lib",
-        "@com_github_twitter_common_rpc//:twitter_common_rpc",
+        requirement("twitter.common.rpc"),
         requirement("six"),
     ],
 )
@@ -36,7 +36,7 @@ py_binary(
         "//test/extensions/filters/network/thrift_proxy/driver/fbthrift:fbthrift_lib",
         "//test/extensions/filters/network/thrift_proxy/driver/finagle:finagle_lib",
         "//test/extensions/filters/network/thrift_proxy/driver/generated/example:example_lib",
-        "@com_github_twitter_common_rpc//:twitter_common_rpc",
+        requirement("twitter.common.rpc"),
         requirement("six"),
     ],
 )
diff --git a/test/extensions/filters/network/thrift_proxy/driver/fbthrift/BUILD b/test/extensions/filters/network/thrift_proxy/driver/fbthrift/BUILD
index 13299104df27..f3808b7b5606 100644
--- a/test/extensions/filters/network/thrift_proxy/driver/fbthrift/BUILD
+++ b/test/extensions/filters/network/thrift_proxy/driver/fbthrift/BUILD
@@ -1,6 +1,6 @@
 load("@rules_python//python:defs.bzl", "py_library")
 load("//bazel:envoy_build_system.bzl", "envoy_package")
-load("@thrift_pip3//:requirements.bzl", "requirement")
+load("@base_pip3//:requirements.bzl", "requirement")
 
 licenses(["notice"])  # Apache 2
 
diff --git a/test/extensions/filters/network/thrift_proxy/driver/finagle/BUILD b/test/extensions/filters/network/thrift_proxy/driver/finagle/BUILD
index 988f9ddcd334..4960615b496a 100644
--- a/test/extensions/filters/network/thrift_proxy/driver/finagle/BUILD
+++ b/test/extensions/filters/network/thrift_proxy/driver/finagle/BUILD
@@ -1,6 +1,6 @@
 load("@rules_python//python:defs.bzl", "py_library")
 load("//bazel:envoy_build_system.bzl", "envoy_package")
-load("@thrift_pip3//:requirements.bzl", "requirement")
+load("@base_pip3//:requirements.bzl", "requirement")
 
 licenses(["notice"])  # Apache 2
 
@@ -14,8 +14,8 @@ py_library(
         "__init__.py",
     ],
     deps = [
-        "@com_github_twitter_common_finagle_thrift//:twitter_common_finagle_thrift",
-        "@com_github_twitter_common_rpc//:twitter_common_rpc",
         requirement("thrift"),
+        requirement("twitter.common.finagle-thrift"),
+        requirement("twitter.common.rpc"),
     ],
 )
diff --git a/test/extensions/filters/network/thrift_proxy/driver/generated/example/BUILD b/test/extensions/filters/network/thrift_proxy/driver/generated/example/BUILD
index 277460b79be9..f7cec3338d58 100644
--- a/test/extensions/filters/network/thrift_proxy/driver/generated/example/BUILD
+++ b/test/extensions/filters/network/thrift_proxy/driver/generated/example/BUILD
@@ -1,6 +1,6 @@
 load("@rules_python//python:defs.bzl", "py_library")
 load("//bazel:envoy_build_system.bzl", "envoy_package")
-load("@thrift_pip3//:requirements.bzl", "requirement")
+load("@base_pip3//:requirements.bzl", "requirement")
 
 licenses(["notice"])  # Apache 2
 
diff --git a/test/extensions/filters/network/thrift_proxy/requirements.in b/test/extensions/filters/network/thrift_proxy/requirements.in
deleted file mode 100644
index 0e405bcd08bc..000000000000
--- a/test/extensions/filters/network/thrift_proxy/requirements.in
+++ /dev/null
@@ -1,2 +0,0 @@
-six
-thrift
diff --git a/test/extensions/filters/network/thrift_proxy/requirements.txt b/test/extensions/filters/network/thrift_proxy/requirements.txt
deleted file mode 100644
index 4b7d0cd7ca83..000000000000
--- a/test/extensions/filters/network/thrift_proxy/requirements.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-six==1.16.0 \
-    --hash=sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926 \
-    --hash=sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254
-thrift==0.15.0 \
-    --hash=sha256:87c8205a71cf8bbb111cb99b1f7495070fbc9cabb671669568854210da5b3e29
diff --git a/tools/base/requirements.in b/tools/base/requirements.in
index a1c1dacbdb62..ba38f02e0b03 100644
--- a/tools/base/requirements.in
+++ b/tools/base/requirements.in
@@ -37,5 +37,8 @@ sphinx-copybutton
 sphinxext-rediraffe
 sphinx-rtd-theme
 sphinx-tabs
+thrift
+twitter.common.rpc==0.3.9
+twitter.common.finagle-thrift
 verboselogs
 yapf
diff --git a/tools/base/requirements.txt b/tools/base/requirements.txt
index 90ed02f455d4..69fff390d7a4 100644
--- a/tools/base/requirements.txt
+++ b/tools/base/requirements.txt
@@ -673,6 +673,7 @@ six==1.16.0 \
     # via
     #   pynacl
     #   sphinxcontrib-httpdomain
+    #   thrift
 slackclient==2.9.3 \
     --hash=sha256:07ec8fa76f6aa64852210ae235ff9e637ba78124e06c0b07a7eeea4abb955965 \
     --hash=sha256:2d68d668c02f4038299897e5c4723ab85dd40a3548354924b24f333a435856f8
@@ -753,6 +754,11 @@ sphinxext-rediraffe==0.2.7 \
     # via
     #   -r requirements.in
     #   envoy.docs.sphinx-runner
+thrift==0.15.0 \
+    --hash=sha256:87c8205a71cf8bbb111cb99b1f7495070fbc9cabb671669568854210da5b3e29
+    # via
+    #   -r requirements.in
+    #   twitter.common.rpc
 toml==0.10.2 \
     --hash=sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b \
     --hash=sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f
@@ -765,6 +771,17 @@ trycast==0.3.0 \
     --hash=sha256:1b7b4c0d4b0d674770a53f34a762e52a6cd6879eb251ab21625602699920080d \
     --hash=sha256:687185b812e8d1c45f2ba841e8de7bdcdee0695dcf3464f206800505d4c65f26
     # via envoy.base.utils
+twitter.common.finagle-thrift==0.3.9 \
+    --hash=sha256:1e3a57d11f94f58745e6b83348ecd4fa74194618704f45444a15bc391fde497a
+    # via
+    #   -r requirements.in
+    #   twitter.common.rpc
+twitter.common.lang==0.3.9 \
+    --hash=sha256:56d1d266fd4767941d11c27061a57bc1266a3342e551bde3780f9e9eb5ad0ed1
+    # via twitter.common.rpc
+twitter.common.rpc==0.3.9 \
+    --hash=sha256:0792b63fb2fb32d970c2e9a409d3d00633190a22eb185145fe3d9067fdaa4514
+    # via -r requirements.in
 typing-extensions==3.10.0.2 \
     --hash=sha256:49f75d16ff11f1cd258e1b988ccff82a3ca5570217d7ad8c5f48205dd99a677e \
     --hash=sha256:d8226d10bc02a29bcc81df19a26e56a9647f8b0a6d4a83924139f4a8b01f17b7 \
diff --git a/tools/code_format/requirements.in b/tools/code_format/requirements.in
new file mode 100644
index 000000000000..dbcef7340827
--- /dev/null
+++ b/tools/code_format/requirements.in
@@ -0,0 +1,4 @@
+flake8
+pep8-naming
+pyflakes==2.4.0
+yapf