diff --git a/tools/harvest_source_import/requirements.txt b/tools/harvest_source_import/requirements.txt
index 7967a512..9fb26a94 100644
--- a/tools/harvest_source_import/requirements.txt
+++ b/tools/harvest_source_import/requirements.txt
@@ -1,3 +1,4 @@
 requests>=2.32.0
 pytest>=5.4.2
 pytest-vcr>=1.0.2
+zipp>=3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability