diff --git a/requirements.txt b/requirements.txt
index 208eb8ec0e5e..3006e5af7c90 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,5 +1,9 @@
 --extra-index-url https://download.pytorch.org/whl/cu132
 -c constraints.txt
+# filelock 4.2.1 requires Python 3.11+. Pin Python 3.10 to 3.20.3 to exclude
+# vulnerable releases 3.20.4 through 4.2.0; newer Python can use 4.2.1 or later.
+filelock==3.20.3; python_version < "3.11"
+filelock>=4.2.1; python_version >= "3.11"
 accelerate>=1.7.0
 build
 colored
diff --git a/security_scanning/pyproject.toml b/security_scanning/pyproject.toml
index 13b696d06cd3..6ccdbf4b45c2 100644
--- a/security_scanning/pyproject.toml
+++ b/security_scanning/pyproject.toml
@@ -91,7 +91,8 @@ dependencies = [
     "cache-dit (>=1.3.5)",
     "msgpack (>=1.2.4,<2.0.0)",
     "uvloop (>=0.19.0,<0.23.0)",
-    "mooncake-transfer-engine-cuda13 (==0.3.13)"
+    "mooncake-transfer-engine-cuda13 (==0.3.13)",
+    "filelock (==3.20.3)"
 ]