diff --git a/.github/workflows/pip-tools.yml b/.github/workflows/pip-tools.yml
index 1a411103a9..6fa083c4a7 100644
--- a/.github/workflows/pip-tools.yml
+++ b/.github/workflows/pip-tools.yml
@@ -147,7 +147,6 @@ jobs:
 
 
         python -m piptools compile
-        --allow-unsafe
         ${{
         (
         github.event_name == 'workflow_dispatch'
@@ -159,9 +158,7 @@ jobs:
         )
         || '--upgrade'
         }}
-        --resolver backtracking
         --output-file="requirements/${BASE_NAME}.txt"
-        --strip-extras
         "requirements/${BASE_NAME}.in"
         setup.cfg
 
diff --git a/.pip-tools.toml b/.pip-tools.toml
new file mode 100644
index 0000000000..97afb0483b
--- /dev/null
+++ b/.pip-tools.toml
@@ -0,0 +1,5 @@
+[tool.pip-tools]
+allow-unsafe = true  # weird outdated default
+generate-hashes = false  # pip bug https://github.com/pypa/pip/issues/9243
+resolver = "backtracking"  # modern depresolver
+strip-extras = true  # so that output files are true pip constraints