diff --git a/requirements/base.txt b/requirements/base.txt
index 04a7c1c5..073a9190 100644
--- a/requirements/base.txt
+++ b/requirements/base.txt
@@ -101,4 +101,5 @@ wagtail-json-widget==0.0.9  # https://pypi.org/project/wagtail-json-widget/
 # Citation export (CSL / BibTeX via citeproc-py)
 # ------------------------------------------------------------------------------
 citeproc-py==0.9.0  # https://pypi.org/project/citeproc-py/
-citeproc-py-styles==0.1.5  # https://pypi.org/project/citeproc-py-styles/ (bibtex.csl, etc.)
\ No newline at end of file
+citeproc-py-styles==0.1.5  # https://pypi.org/project/citeproc-py-styles/ (bibtex.csl, etc.)
+lxml>=6.1.0 # not directly required, pinned by Snyk to avoid a vulnerability
\ No newline at end of file