diff --git a/requirements-gmusic.txt b/requirements-gmusic.txt
index 39e13ce36..27fff6d86 100644
--- a/requirements-gmusic.txt
+++ b/requirements-gmusic.txt
@@ -1,3 +1,4 @@
 # Google Music related requirements (in addition to requirements-spotify.txt)
 # You need to install these with `sudo pip install --upgrade --force-reinstall -r requirements-gmusic.txt`
 Mopidy-Gmusic
+tornado>=6.3.3 # not directly required, pinned by Snyk to avoid a vulnerability