diff --git a/setup/playbooks/roles/mirrors/files/devpi/requirements.txt b/setup/playbooks/roles/mirrors/files/devpi/requirements.txt
index 771affc7..471eece5 100644
--- a/setup/playbooks/roles/mirrors/files/devpi/requirements.txt
+++ b/setup/playbooks/roles/mirrors/files/devpi/requirements.txt
@@ -2,3 +2,4 @@ devpi-server==5.5.1
 devpi-client
 devpi-web
 ruamel_yaml
+setuptools>=70.0.0 # not directly required, pinned by Snyk to avoid a vulnerability