diff --git a/requirements.txt b/requirements.txt
index 4adbbdd..e5be907 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,3 +1,4 @@
 httpx~=0.28.0
 fastmcp~=2.11.0
 pyyaml~=6.0.0
+werkzeug>=3.1.4 # not directly required, pinned by Snyk to avoid a vulnerability