diff --git a/requirements.txt b/requirements.txt
index d8b6e0742f..abad8e6f6c 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -12,7 +12,7 @@ botocore>=1.35,<1.36
 celery>=5.2.6
 coverage>=4.5.4,<5.0    # Coverage 5.x moves from a json database to SQLite.  Moving to 5.x will require substantial rewrites in ietf.utils.test_runner and ietf.release.views
 defusedxml>=0.7.1    # for TastyPie when using xml; not a declared dependency
-Django>4.2,<5
+Django>4.2.28
 django-analytical>=3.1.0
 django-bootstrap5>=21.3
 django-celery-beat>=2.3.0
@@ -83,3 +83,4 @@ urllib3>=1.26,<2
 weasyprint>=64.1
 xml2rfc>=3.23.0
 xym>=0.6,<1.0
+zipp>=3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability