diff --git a/dev-requirements-2.9.txt b/dev-requirements-2.9.txt
index 4356d9c..c71a676 100644
--- a/dev-requirements-2.9.txt
+++ b/dev-requirements-2.9.txt
@@ -30,3 +30,4 @@ progressbar==2.5
 -e git+https://github.com/qld-gov-au/ckanext-ytp-comments.git@2.5.0-qgov.15#egg=ckanext-ytp-comments
 -e git+https://github.com/qld-gov-au/ckanext-resource-visibility.git@2.1.1#egg=ckanext-resource-visibility
 -e git+https://github.com/qld-gov-au/ckanext-validation-schema-generator.git@develop#egg=ckanext-validation-schema-generator
+urllib3>=2.2.2 # not directly required, pinned by Snyk to avoid a vulnerability