diff --git a/requirements/prod.txt b/requirements/prod.txt
old mode 100755
new mode 100644
index 5567a3301..5997c5eb6
--- a/requirements/prod.txt
+++ b/requirements/prod.txt
@@ -8,3 +8,4 @@ Flask-WTF==0.15.1
 email_validator==1.1.3
 python-dotenv==0.19.1
 prometheus-flask-exporter==0.18.5
+werkzeug>=3.1.5 # not directly required, pinned by Snyk to avoid a vulnerability