diff --git a/requirements.txt b/requirements.txt
index ac4b68a..23ef0c3 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -12,3 +12,5 @@ pre-commit
 arcade
 pyglet
 mypy
+# pip-audit: subdependency explicitly fixed
+pillow==12.1.1