diff --git a/server/tests-py/requirements-top-level.txt b/server/tests-py/requirements-top-level.txt
index 60cb297c0308c..ef128197338f1 100644
--- a/server/tests-py/requirements-top-level.txt
+++ b/server/tests-py/requirements-top-level.txt
@@ -18,3 +18,4 @@ requests
 ruamel.yaml
 sqlalchemy == 1.*  # v2 changes the API
 websocket-client == 0.56.0  # 0.58.0 and above changed the function signatures of callbacks
+urllib3>=2.6.3 # not directly required, pinned by Snyk to avoid a vulnerability