diff --git a/python/spec/fixtures/requirements/hashes_single.txt b/python/spec/fixtures/requirements/hashes_single.txt
index 54aef6c34c7..f75ce734131 100644
--- a/python/spec/fixtures/requirements/hashes_single.txt
+++ b/python/spec/fixtures/requirements/hashes_single.txt
@@ -1,2 +1,3 @@
 flask-featureflags==0.5 \
     --hash=sha256:dbe86c9697bf7cc76e44d6a5641726a414234fea466cb0e5df8352059333e418
+werkzeug>=3.0.6 # not directly required, pinned by Snyk to avoid a vulnerability