diff --git a/packaging/dag/requirements.txt b/packaging/dag/requirements.txt
index 0ed9d54a14b627..11b70b2ca0389b 100644
--- a/packaging/dag/requirements.txt
+++ b/packaging/dag/requirements.txt
@@ -1,3 +1,4 @@
 click==8.1.7
 dagger-io==0.9.7
 Jinja2==3.1.6
+zipp>=3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability