diff --git a/app-engine/shaka-player-demo/requirements.txt b/app-engine/shaka-player-demo/requirements.txt
index ddc9d6f206..17297a1e30 100644
--- a/app-engine/shaka-player-demo/requirements.txt
+++ b/app-engine/shaka-player-demo/requirements.txt
@@ -3,3 +3,4 @@
 # SPDX-License-Identifier: Apache-2.0
 
 Flask==2.2.5
+werkzeug>=3.0.3 # not directly required, pinned by Snyk to avoid a vulnerability