diff --git a/appengine/standard/firebase/firetactoe/requirements.txt b/appengine/standard/firebase/firetactoe/requirements.txt
index 578fcb891c8..c3c1566bd25 100644
--- a/appengine/standard/firebase/firetactoe/requirements.txt
+++ b/appengine/standard/firebase/firetactoe/requirements.txt
@@ -3,3 +3,4 @@ requests==2.21.0
 requests_toolbelt==0.9.1
 oauth2client==4.1.3
 functools32==3.2.3.post2; python_version < "3"
+urllib3>=2.6.0 # not directly required, pinned by Snyk to avoid a vulnerability