diff --git a/appengine/flexible/websockets/requirements.txt b/appengine/flexible/websockets/requirements.txt
index eb3d426fe9..e23dc42246 100644
--- a/appengine/flexible/websockets/requirements.txt
+++ b/appengine/flexible/websockets/requirements.txt
@@ -4,3 +4,4 @@ gunicorn==23.0.0
 requests==2.34.2; python_version >= '3.10'
 markupsafe==2.0.1
 Werkzeug==3.1.8; python_version >= '3.9'
+zipp>=3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability