diff --git a/template/python3-flask-debian/requirements.txt b/template/python3-flask-debian/requirements.txt
index 5c3b5e8..994f49c 100644
--- a/template/python3-flask-debian/requirements.txt
+++ b/template/python3-flask-debian/requirements.txt
@@ -1,3 +1,4 @@
 flask
 waitress
 tox==3.*
+werkzeug>=3.0.6 # not directly required, pinned by Snyk to avoid a vulnerability