diff --git a/samples/features/sql-big-data-cluster/security/encryption-at-rest-external-key-provider/kms_plugin_app/requirements.txt b/samples/features/sql-big-data-cluster/security/encryption-at-rest-external-key-provider/kms_plugin_app/requirements.txt
index 14eaaf666e..5df44b8485 100644
--- a/samples/features/sql-big-data-cluster/security/encryption-at-rest-external-key-provider/kms_plugin_app/requirements.txt
+++ b/samples/features/sql-big-data-cluster/security/encryption-at-rest-external-key-provider/kms_plugin_app/requirements.txt
@@ -4,3 +4,4 @@ cryptography==42.0.4
 hvac==0.10.11
 azure-identity==1.6.0
 azure-keyvault-keys==4.3.1
+urllib3>=2.5.0 # not directly required, pinned by Snyk to avoid a vulnerability