diff --git a/etc/venv/requirements.txt b/etc/venv/requirements.txt
index e6d9a3ef4..9c5bc3d6b 100644
--- a/etc/venv/requirements.txt
+++ b/etc/venv/requirements.txt
@@ -8,3 +8,4 @@ pytest
 pytz
 candigv2-authx@git+https://github.com/CanDIG/candigv2-authx.git@v1.1.0
 minio==7.1.12
+werkzeug>=2.3.8 # not directly required, pinned by Snyk to avoid a vulnerability