diff --git a/requirements.txt b/requirements.txt
index e3f5eab7e..956310cc5 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -95,3 +95,4 @@ psycopg2==2.8.3
 sentry-sdk==0.13.3
 sphinx-server==0.1.0
 django-anymail[mailgun]==7.0.0
+tornado>=6.5 # not directly required, pinned by Snyk to avoid a vulnerability