diff --git a/optional-requirements.txt b/optional-requirements.txt
index e6ee37e3f..46fea3b1d 100644
--- a/optional-requirements.txt
+++ b/optional-requirements.txt
@@ -1,4 +1,5 @@
 Flask==2.3.2
 Flask-WTF==1.1.0
 MarkupSafe==2.1.1
-flask-babel==3.0.0
\ No newline at end of file
+flask-babel==3.0.0
+werkzeug>=3.0.6 # not directly required, pinned by Snyk to avoid a vulnerability
\ No newline at end of file