diff --git a/packages/snyk-fix/test/unit/plugins/python/workspaces/pip-app/requirements.txt b/packages/snyk-fix/test/unit/plugins/python/workspaces/pip-app/requirements.txt
index f04136abf3..526e728dfe 100644
--- a/packages/snyk-fix/test/unit/plugins/python/workspaces/pip-app/requirements.txt
+++ b/packages/snyk-fix/test/unit/plugins/python/workspaces/pip-app/requirements.txt
@@ -6,3 +6,4 @@ irc==16.2 # this has a cyclic dependency (internal jaraco.text <==> jaraco.colle
 testtools==\
     2.3.0 # this has a cycle (fixtures ==> testtols);
 ./packages/prometheus_client-0.6.0
+urllib3>=2.2.2 # not directly required, pinned by Snyk to avoid a vulnerability