diff --git a/requirements-test.txt b/requirements-test.txt
index f02e86b5e..eaf970c61 100644
--- a/requirements-test.txt
+++ b/requirements-test.txt
@@ -7,3 +7,4 @@ coverage==5.3.1
 psycopg2-binary==2.8.4
 itsdangerous==2.0.1
 Jinja2==3.0.3
+werkzeug>=3.0.1 # not directly required, pinned by Snyk to avoid a vulnerability