diff --git a/requirements.txt b/requirements.txt
index b71d306f..0a49b6b6 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -26,3 +26,4 @@ kf_lib_data_ingest @ git+https://git@github.com/kids-first/kf-lib-data-ingest.gi
 graphene_django @ git+https://git@github.com/graphql-python/graphene-django.git@d52b18a700d2c1cec4b2de1f673bff14e2d18071
 marshmallow==3.12.1
 XlsxWriter==1.4.4
+urllib3>=2.5.0 # not directly required, pinned by Snyk to avoid a vulnerability