diff --git a/requirements.txt b/requirements.txt
index 4225aa8277f10..c11ff0324749e 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -49,3 +49,4 @@ requests-aws4auth==0.9
 sasl>=0.2.1
 six>=1.12.0                    #basic-lib
 xmltodict>=0.11.0
+werkzeug>=3.0.3 # not directly required, pinned by Snyk to avoid a vulnerability