diff --git a/requirements-release.txt b/requirements-release.txt
index 9a9d8535153..e2e32d38086 100644
--- a/requirements-release.txt
+++ b/requirements-release.txt
@@ -14,3 +14,4 @@ twine
 wheel
 # Dependencies for the reference implementation.
 -r requirements-reference.txt
+tornado>=6.4.2 # not directly required, pinned by Snyk to avoid a vulnerability