diff --git a/conda.recipe/requirements.txt b/conda.recipe/requirements.txt
index 85c1f4c4..6f278ee8 100644
--- a/conda.recipe/requirements.txt
+++ b/conda.recipe/requirements.txt
@@ -4,3 +4,4 @@ hvplot
 panel
 pandas
 
+tornado>=6.3.2 # not directly required, pinned by Snyk to avoid a vulnerability