diff --git a/requirements.txt b/requirements.txt
index 0ba969f0..71115690 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -24,3 +24,4 @@ threddsclient==0.4.4
 typing_extensions
 watchdog
 webob
+tornado>=6.4.1 # not directly required, pinned by Snyk to avoid a vulnerability