diff --git a/composer/workflows/requirements-composer.txt b/composer/workflows/requirements-composer.txt
index 93d3e924ad7..58905dad56a 100644
--- a/composer/workflows/requirements-composer.txt
+++ b/composer/workflows/requirements-composer.txt
@@ -1 +1,2 @@
 apache-airflow-backport-providers-google==2021.3.3
+marshmallow>=3.26.2 # not directly required, pinned by Snyk to avoid a vulnerability