diff --git a/app-engine/shaka-player-demo/requirements.txt b/app-engine/shaka-player-demo/requirements.txt
index ddc9d6f206..2523466ae3 100644
--- a/app-engine/shaka-player-demo/requirements.txt
+++ b/app-engine/shaka-player-demo/requirements.txt
@@ -3,3 +3,4 @@
 # SPDX-License-Identifier: Apache-2.0
 
 Flask==2.2.5
+zipp>=3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability