diff --git a/app-engine/demo-version-index/requirements.txt b/app-engine/demo-version-index/requirements.txt
index ae64326a2f..d0c5cbe03c 100644
--- a/app-engine/demo-version-index/requirements.txt
+++ b/app-engine/demo-version-index/requirements.txt
@@ -3,3 +3,4 @@
 # SPDX-License-Identifier: Apache-2.0
 
 Flask==2.2.5
+werkzeug>=3.0.3 # not directly required, pinned by Snyk to avoid a vulnerability