diff --git a/.travis/install.sh b/.travis/install.sh
index 2ae9c20a0..0bff14cca 100755
--- a/.travis/install.sh
+++ b/.travis/install.sh
@@ -4,26 +4,29 @@ set -e
 set -x
 
 if [[ "$(uname -s)" == 'Darwin' ]]; then
-    # HOMEBREW_NO_AUTO_UPDATE=1
+    export HOMEBREW_NO_AUTO_UPDATE=1
     export HOMEBREW_LOGS=~/brew-logs
     export HOMEBREW_TEMP=~/brew-temp
     mkdir $HOMEBREW_LOGS
     mkdir $HOMEBREW_TEMP
-    # brew update
-    if [[ "${OPENSSL}" != "0.9.8" ]]; then
-        brew outdated openssl || brew upgrade openssl
-    fi
+    brew update > /dev/null
+    brew cleanup > /dev/null  # do this here, so it won't automatically trigger in the middle of other stuff
+    brew outdated pkg-config || brew upgrade pkg-config
+    # do NOT update openssl 1.0.x, brew will also update a lot of dependent pkgs (and their dependencies) then!
+    #brew outdated openssl || brew upgrade openssl
+    export PKG_CONFIG_PATH="/usr/local/opt/openssl/lib/pkgconfig:$PKG_CONFIG_PATH"
+    brew install readline
+    export PKG_CONFIG_PATH="/usr/local/opt/readline/lib/pkgconfig:$PKG_CONFIG_PATH"
+    brew install zstd
+    brew install lz4
+    brew install xz  # required for python lzma module
+    brew install Caskroom/cask/osxfuse
 
+    brew outdated pyenv || brew upgrade pyenv
     if which pyenv > /dev/null; then
         eval "$(pyenv init -)"
     fi
 
-    brew install lz4
-    brew install xz  # required for python lzma module
-    brew outdated pyenv || brew upgrade pyenv
-    brew install pkg-config
-    brew install Caskroom/cask/osxfuse
-
     case "${TOXENV}" in
         py35)
             pyenv install 3.5.2
@@ -39,10 +42,10 @@ if [[ "$(uname -s)" == 'Darwin' ]]; then
 else
     pip install virtualenv
     sudo apt-get update
-    sudo apt-get install -y fakeroot
-    sudo apt-get install -y liblz4-dev
+    sudo apt-get install -y pkg-config fakeroot
+    #sudo apt-get install -y liblz4-dev  # too old on trusty and xenial
+    #sudo apt-get install -y libzstd-dev  # too old on trusty and xenial
     sudo apt-get install -y libacl1-dev
-    sudo apt-get install -y pkg-config
     sudo apt-get install -y libfuse-dev fuse  # optional, for FUSE support
 fi
 
diff --git a/.travis/run.sh b/.travis/run.sh
index 91f6f7663..e24a11c32 100755
--- a/.travis/run.sh
+++ b/.travis/run.sh
@@ -5,14 +5,13 @@ set -x
 
 if [[ "$(uname -s)" == "Darwin" ]]; then
     eval "$(pyenv init -)"
-    if [[ "${OPENSSL}" != "0.9.8" ]]; then
-        # set our flags to use homebrew openssl
-        export ARCHFLAGS="-arch x86_64"
-        export LDFLAGS="-L/usr/local/opt/openssl/lib"
-        export CFLAGS="-I/usr/local/opt/openssl/include"
-    fi
+    # set our flags to use homebrew openssl
+    export ARCHFLAGS="-arch x86_64"
+    export PKG_CONFIG_PATH="/usr/local/opt/openssl/lib/pkgconfig:$PKG_CONFIG_PATH"
+    #export LDFLAGS="-L/usr/local/opt/openssl/lib"
+    #export CFLAGS="-I/usr/local/opt/openssl/include"
 fi
 
 # do not use fakeroot, but run as root on travis.
 # avoids the dreaded EISDIR sporadic failures. see #2482.
-sudo bash -c "source ~/.venv/bin/activate ; tox -e $TOXENV -r"
+sudo -E bash -c "source ~/.venv/bin/activate ; tox -e $TOXENV -r"