diff --git a/lib/ansible/cli/__init__.py b/lib/ansible/cli/__init__.py
index c2195c7b08..e2e90845d6 100644
--- a/lib/ansible/cli/__init__.py
+++ b/lib/ansible/cli/__init__.py
@@ -96,7 +96,7 @@ class InvalidOptsParser(SortedOptParser):
 class CLI(with_metaclass(ABCMeta, object)):
     ''' code behind bin/ansible* programs '''
 
-    VALID_ACTIONS = []
+    VALID_ACTIONS = frozenset()
 
     _ITALIC = re.compile(r"I\(([^)]+)\)")
     _BOLD = re.compile(r"B\(([^)]+)\)")
diff --git a/lib/ansible/cli/config.py b/lib/ansible/cli/config.py
index 413766e72b..a727924283 100644
--- a/lib/ansible/cli/config.py
+++ b/lib/ansible/cli/config.py
@@ -25,7 +25,7 @@ display = Display()
 class ConfigCLI(CLI):
     """ Config command line class """
 
-    VALID_ACTIONS = ("view", "dump", "list")  # TODO: edit, update, search
+    VALID_ACTIONS = frozenset(("view", "dump", "list"))  # TODO: edit, update, search
 
     def __init__(self, args, callback=None):
 
@@ -36,7 +36,7 @@ class ConfigCLI(CLI):
     def parse(self):
 
         self.parser = CLI.base_parser(
-            usage="usage: %%prog [%s] [--help] [options] [ansible.cfg]" % "|".join(self.VALID_ACTIONS),
+            usage="usage: %%prog [%s] [--help] [options] [ansible.cfg]" % "|".join(sorted(self.VALID_ACTIONS)),
             epilog="\nSee '%s <command> --help' for more information on a specific command.\n\n" % os.path.basename(sys.argv[0]),
             desc="View, edit, and manage ansible configuration.",
         )
diff --git a/lib/ansible/cli/galaxy.py b/lib/ansible/cli/galaxy.py
index 54843888e9..ca4bbc7c26 100644
--- a/lib/ansible/cli/galaxy.py
+++ b/lib/ansible/cli/galaxy.py
@@ -50,7 +50,7 @@ class GalaxyCLI(CLI):
     '''command to manage Ansible roles in shared repositories, the default of which is Ansible Galaxy *https://galaxy.ansible.com*.'''
 
     SKIP_INFO_KEYS = ("name", "description", "readme_html", "related", "summary_fields", "average_aw_composite", "average_aw_score", "url")
-    VALID_ACTIONS = ("delete", "import", "info", "init", "install", "list", "login", "remove", "search", "setup")
+    VALID_ACTIONS = frozenset(("delete", "import", "info", "init", "install", "list", "login", "remove", "search", "setup"))
 
     def __init__(self, args):
         self.api = None
@@ -135,7 +135,7 @@ class GalaxyCLI(CLI):
         ''' create an options parser for bin/ansible '''
 
         self.parser = CLI.base_parser(
-            usage="usage: %%prog [%s] [--help] [options] ..." % "|".join(self.VALID_ACTIONS),
+            usage="usage: %%prog [%s] [--help] [options] ..." % "|".join(sorted(self.VALID_ACTIONS)),
             epilog="\nSee '%s <command> --help' for more information on a specific command.\n\n" % os.path.basename(sys.argv[0]),
             desc="Perform various Role related operations.",
         )
diff --git a/lib/ansible/cli/vault.py b/lib/ansible/cli/vault.py
index 0407680919..1b0ae67db2 100644
--- a/lib/ansible/cli/vault.py
+++ b/lib/ansible/cli/vault.py
@@ -46,7 +46,7 @@ class VaultCLI(CLI):
     The password used with vault currently must be the same for all files you wish to use together at the same time.
     '''
 
-    VALID_ACTIONS = ("create", "decrypt", "edit", "encrypt", "encrypt_string", "rekey", "view")
+    VALID_ACTIONS = frozenset(("create", "decrypt", "edit", "encrypt", "encrypt_string", "rekey", "view"))
 
     FROM_STDIN = "stdin"
     FROM_ARGS = "the command line args"
@@ -114,7 +114,7 @@ class VaultCLI(CLI):
         self.parser = CLI.base_parser(
             vault_opts=True,
             vault_rekey_opts=True,
-            usage="usage: %%prog [%s] [options] [vaultfile.yml]" % "|".join(self.VALID_ACTIONS),
+            usage="usage: %%prog [%s] [options] [vaultfile.yml]" % "|".join(sorted(self.VALID_ACTIONS)),
             desc="encryption/decryption utility for Ansible data files",
             epilog="\nSee '%s <command> --help' for more information on a specific command.\n\n" % os.path.basename(sys.argv[0])
         )