diff --git a/requirements/dev-bookworm-requirements.txt b/requirements/dev-bookworm-requirements.txt
index 47b9000edc..ff6bd04221 100644
--- a/requirements/dev-bookworm-requirements.txt
+++ b/requirements/dev-bookworm-requirements.txt
@@ -185,6 +185,10 @@ isort==5.10.1 \
     --hash=sha256:6f62d78e2f89b4500b080fe3a81690850cd254227f27f75c3a0c491a1f351ba7 \
     --hash=sha256:e8443a5e7a020e9d7f97f1d7d9cd17c88bcb3bc7e218bf9cf5095fe550be2951
     # via -r requirements/dev-sdw-requirements.in
+jinja2==3.0.2 \
+    --hash=sha256:827a0e32839ab1600d4eb1c4c33ec5a8edfbc5cb42dafa13b81f182f97784b45 \
+    --hash=sha256:8569982d3f0889eed11dd620c706d39b60c36d6d25843961f33f77fb6bc6b20c
+    # via -r requirements/requirements.in
 jsonschema==4.16.0 \
     --hash=sha256:165059f076eff6971bae5b742fc029a7b4ef3f9bcf04c14e4776a7605de14b23 \
     --hash=sha256:9e74b8f9738d6a946d70705dc692b74b5429cd0960d58e79ffecfc43b2221eb9
@@ -239,6 +243,7 @@ markupsafe==2.1.1 \
     # via
     #   -r requirements/dev-sdw-requirements.in
     #   -r requirements/requirements.in
+    #   jinja2
     #   mako
 mccabe==0.7.0 \
     --hash=sha256:348e0240c33b60bbdf4e523192ef919f28cb2c3d7d5c7794f74009290f236325 \
@@ -737,6 +742,7 @@ typing-extensions==4.3.0 \
     --hash=sha256:25642c956049920a5aa49edcdd6ab1e06d7e5d467fc00e0506c44ac86fbfca02 \
     --hash=sha256:e6d2677a32f47fc7eb2795db1dd15c1f34eff616bcaf2cfb5e997f854fa1c4a6
     # via
+    #   black
     #   mypy
     #   semgrep
 ujson==5.5.0 \
diff --git a/requirements/dev-bullseye-requirements.txt b/requirements/dev-bullseye-requirements.txt
index 1eed76ca05..b35c4153f7 100644
--- a/requirements/dev-bullseye-requirements.txt
+++ b/requirements/dev-bullseye-requirements.txt
@@ -185,6 +185,10 @@ isort==5.10.1 \
     --hash=sha256:6f62d78e2f89b4500b080fe3a81690850cd254227f27f75c3a0c491a1f351ba7 \
     --hash=sha256:e8443a5e7a020e9d7f97f1d7d9cd17c88bcb3bc7e218bf9cf5095fe550be2951
     # via -r requirements/dev-sdw-requirements.in
+jinja2==3.0.2 \
+    --hash=sha256:827a0e32839ab1600d4eb1c4c33ec5a8edfbc5cb42dafa13b81f182f97784b45 \
+    --hash=sha256:8569982d3f0889eed11dd620c706d39b60c36d6d25843961f33f77fb6bc6b20c
+    # via -r requirements/requirements.in
 jsonschema==4.16.0 \
     --hash=sha256:165059f076eff6971bae5b742fc029a7b4ef3f9bcf04c14e4776a7605de14b23 \
     --hash=sha256:9e74b8f9738d6a946d70705dc692b74b5429cd0960d58e79ffecfc43b2221eb9
@@ -239,6 +243,7 @@ markupsafe==2.1.1 \
     # via
     #   -r requirements/dev-sdw-requirements.in
     #   -r requirements/requirements.in
+    #   jinja2
     #   mako
 mccabe==0.7.0 \
     --hash=sha256:348e0240c33b60bbdf4e523192ef919f28cb2c3d7d5c7794f74009290f236325 \
diff --git a/requirements/dev-sdw-requirements.txt b/requirements/dev-sdw-requirements.txt
index 20c10a6ebd..fd98c9e205 100644
--- a/requirements/dev-sdw-requirements.txt
+++ b/requirements/dev-sdw-requirements.txt
@@ -176,6 +176,10 @@ isort==5.10.1 \
     --hash=sha256:6f62d78e2f89b4500b080fe3a81690850cd254227f27f75c3a0c491a1f351ba7 \
     --hash=sha256:e8443a5e7a020e9d7f97f1d7d9cd17c88bcb3bc7e218bf9cf5095fe550be2951
     # via -r requirements/dev-sdw-requirements.in
+jinja2==3.0.2 \
+    --hash=sha256:827a0e32839ab1600d4eb1c4c33ec5a8edfbc5cb42dafa13b81f182f97784b45 \
+    --hash=sha256:8569982d3f0889eed11dd620c706d39b60c36d6d25843961f33f77fb6bc6b20c
+    # via -r requirements/requirements.in
 jsonschema==3.2.0 \
     --hash=sha256:4e5b3cf8216f577bee9ce139cbe72eca3ea4f292ec60928ff24758ce626cd163 \
     --hash=sha256:c8a85b28d377cc7737e46e2d9f2b4f44ee3c0e1deac6bf46ddefc7187d30797a
@@ -230,6 +234,7 @@ markupsafe==2.1.1 \
     # via
     #   -r requirements/dev-sdw-requirements.in
     #   -r requirements/requirements.in
+    #   jinja2
     #   mako
 mccabe==0.6.1 \
     --hash=sha256:ab8a6258860da4b6677da4bd2fe5dc2c659cff31b3ee4f7f5d64e79735b80d42 \
diff --git a/requirements/requirements.in b/requirements/requirements.in
index ac731f6b88..b7a16a5ced 100644
--- a/requirements/requirements.in
+++ b/requirements/requirements.in
@@ -13,3 +13,4 @@ securedrop-sdk==0.4.0
 six==1.11.0
 sqlalchemy==1.3.3
 urllib3>=1.26.5
+jinja2==3.0.2  # per freedomofpress/securedrop#4829953
diff --git a/requirements/requirements.txt b/requirements/requirements.txt
index f579c18c49..654ba66c67 100644
--- a/requirements/requirements.txt
+++ b/requirements/requirements.txt
@@ -28,6 +28,10 @@ idna==3.2 \
     # via
     #   -r requirements/requirements.in
     #   requests
+jinja2==3.0.2 \
+    --hash=sha256:827a0e32839ab1600d4eb1c4c33ec5a8edfbc5cb42dafa13b81f182f97784b45 \
+    --hash=sha256:8569982d3f0889eed11dd620c706d39b60c36d6d25843961f33f77fb6bc6b20c
+    # via -r requirements/requirements.in
 mako==1.2.2 \
     --hash=sha256:3724869b363ba630a272a5f89f68c070352137b8fd1757650017b7e06fda163f \
     --hash=sha256:8efcb8004681b5f71d09c983ad5a9e6f5c40601a6ec469148753292abc0da534
@@ -91,6 +95,7 @@ markupsafe==2.0.1 \
     --hash=sha256:fa130dd50c57d53368c9d59395cb5526eda596d3ffe36666cd81a44d56e48872
     # via
     #   -r requirements/requirements.in
+    #   jinja2
     #   mako
 pathlib2==2.3.2 \
     --hash=sha256:8eb170f8d0d61825e09a95b38be068299ddeda82f35e96c3301a8a5e7604cb83 \