diff --git a/requirements.txt b/requirements.txt
index dbeaee3b6..1bdd6d8fe 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -9,3 +9,4 @@ google-api-core[grpc] >= 1.14.0, < 2.0.0dev; platform.python_implementation != '
 google-api-python-client >= 1.7.8
 google-cloud-firestore >= 1.4.0; platform.python_implementation != 'PyPy'
 google-cloud-storage >= 1.18.0
+werkzeug>=3.1.4 # not directly required, pinned by Snyk to avoid a vulnerability