diff --git a/requirements/test.txt b/requirements/test.txt
index 01c2f4ce0..5d6132a76 100644
--- a/requirements/test.txt
+++ b/requirements/test.txt
@@ -8,3 +8,4 @@ moto==2.2.4
 -r exporter/gspread.txt
 -r parser/sqlglot.txt
 -r ai/langchain.txt
+werkzeug>=3.0.1 # not directly required, pinned by Snyk to avoid a vulnerability