diff --git a/apps/es_idx_manager/requirements.txt b/apps/es_idx_manager/requirements.txt
index f06315b..3751d71 100644
--- a/apps/es_idx_manager/requirements.txt
+++ b/apps/es_idx_manager/requirements.txt
@@ -3,3 +3,4 @@ botocore==1.10.33
 PyYAML==4.2b1
 retrying==1.3.3
 dcplib
+urllib3>=2.2.2 # not directly required, pinned by Snyk to avoid a vulnerability