diff --git a/requirements-local-forks.txt b/requirements-local-forks.txt
index a525e1e79e..2be988f575 100644
--- a/requirements-local-forks.txt
+++ b/requirements-local-forks.txt
@@ -1,6 +1,7 @@
 -e git+git://github.com/annatrz/invenio-deposit.git#egg=invenio-deposit
 # -e git+git://github.com/reanahub/reana-client.git@master#egg=reana-client
 # -e git+git://github.com/reanahub/reana-commons.git@master#egg=reana-commons
+cryptography<=3.3.2
 reana-client==0.6.0
 reana-commons==0.6.0
 -e git+git://github.com/cernanalysispreservation/invenio-oauthclient.git@master#egg=invenio-oauthclient
diff --git a/requirements.txt b/requirements.txt
index 52acbd4e02..f7b9268d80 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -24,7 +24,7 @@ chardet==3.0.4            # via binaryornot, requests
 click==6.7                # via cookiecutter, dojson, flask, flask-cli, flask-shell-ipython
 cookiecutter==1.6.0       # via invenio-base
 coolname==1.1.0
-cryptography==2.2.2       # via invenio-accounts, pyopenssl, sqlalchemy-utils, urllib3
+cryptography==3.3.2       # via invenio-accounts, pyopenssl, sqlalchemy-utils, urllib3
 decorator==4.3.0          # via ipython, traitlets, validators
 dojson==1.4.0             # via invenio-oaiserver
 elasticsearch-dsl==5.4.0  # via invenio-search
diff --git a/setup.py b/setup.py
index 100693a49a..4e84c389b9 100644
--- a/setup.py
+++ b/setup.py
@@ -61,6 +61,9 @@
     'python-gitlab>=1.0.2',
     'python-cern-sso-krb==1.3.3',
     'python-gssapi==0.6.4',
+    # FIX cryptography <=3.3.2 is needed for installation not to crash
+    # https://github.com/Azure/azure-cli/issues/16858
+    'cryptography<=3.3.2',
     'paramiko==2.7.1',
     'cachetools==3.1.0',