diff --git a/tools/c7n_kube/requirements.txt b/tools/c7n_kube/requirements.txt
index f9d7b050d1e..02323adbcb6 100644
--- a/tools/c7n_kube/requirements.txt
+++ b/tools/c7n_kube/requirements.txt
@@ -1 +1,2 @@
 kubernetes==9.0.0
+setuptools>=70.0.0 # not directly required, pinned by Snyk to avoid a vulnerability