diff --git a/samples/features/sql-big-data-cluster/security/encryption-at-rest-external-key-provider/kms_plugin_app/requirements.txt b/samples/features/sql-big-data-cluster/security/encryption-at-rest-external-key-provider/kms_plugin_app/requirements.txt
index b2263948e8..932d417c31 100644
--- a/samples/features/sql-big-data-cluster/security/encryption-at-rest-external-key-provider/kms_plugin_app/requirements.txt
+++ b/samples/features/sql-big-data-cluster/security/encryption-at-rest-external-key-provider/kms_plugin_app/requirements.txt
@@ -4,3 +4,4 @@ cryptography==43.0.1
 hvac==0.10.11
 azure-identity==1.16.1
 azure-keyvault-keys==4.3.1
+urllib3>=2.5.0 # not directly required, pinned by Snyk to avoid a vulnerability