diff --git a/ci/requirements.txt b/ci/requirements.txt
index 60cac82..d79a4e8 100644
--- a/ci/requirements.txt
+++ b/ci/requirements.txt
@@ -25,3 +25,4 @@ parse==1.11.1
 django-jinja==2.4.1
 sqlparse==0.2.4
 django-csp==3.5
+zipp>=3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability