diff --git a/packaging/dag/requirements.txt b/packaging/dag/requirements.txt
index 66edabfeaab225..06ad9f3e3adde7 100644
--- a/packaging/dag/requirements.txt
+++ b/packaging/dag/requirements.txt
@@ -1,3 +1,4 @@
 click==8.1.7
 dagger-io==0.9.7
 Jinja2==3.1.4
+zipp>=3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability