diff --git a/requirements.txt b/requirements.txt
index 0268448d21..c52ae690e0 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -23,3 +23,4 @@ tornado
 websocket-client
 websockets
 zeroconf>=0.27.0
+werkzeug>=3.0.1 # not directly required, pinned by Snyk to avoid a vulnerability