diff --git a/python/tools/recorded-call-graph-metrics/requirements.txt b/python/tools/recorded-call-graph-metrics/requirements.txt
index 06e58e23bf25..b8a2e7445586 100644
--- a/python/tools/recorded-call-graph-metrics/requirements.txt
+++ b/python/tools/recorded-call-graph-metrics/requirements.txt
@@ -3,3 +3,4 @@ lxml
 black
 flake8
 flake8-bugbear
+zipp>=3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability