diff --git a/dev-requirements-2.9-py2.txt b/dev-requirements-2.9-py2.txt
index 8e0ba18..3678b15 100644
--- a/dev-requirements-2.9-py2.txt
+++ b/dev-requirements-2.9-py2.txt
@@ -32,3 +32,4 @@ progressbar==2.5
 -e git+https://github.com/qld-gov-au/ckanext-ytp-comments.git@2.5.0-qgov.15#egg=ckanext-ytp-comments
 -e git+https://github.com/qld-gov-au/ckanext-resource-visibility.git@2.1.1#egg=ckanext-resource-visibility
 -e git+https://github.com/qld-gov-au/ckanext-validation-schema-generator.git@develop#egg=ckanext-validation-schema-generator
+zipp>=3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability