diff --git a/CHANGELOG.md b/CHANGELOG.md
index b0d821963..e22f3ca7e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Infrastructure
 * Fix readthedocs build by updating to v2 configuration schema
 * Fix spellcheck erroring out on LICENSE file
+* Fix snyk reporting vulnerability due to tornado package use in docs generation
 
 ## [1.24.1] - 2023-09-27
 
diff --git a/requirements-doc.txt b/requirements-doc.txt
index 0ec0116ec..376ee81dd 100644
--- a/requirements-doc.txt
+++ b/requirements-doc.txt
@@ -4,3 +4,4 @@ sphinx-autobuild
 sphinx-rtd-theme
 sphinx_autodoc_typehints
 sphinxcontrib-plantuml
+tornado>=6.3.3 # not directly required, pinned by Snyk to avoid a vulnerability