diff --git a/Scrapy-release-procedure.md b/Scrapy-release-procedure.md
index 5e4dda0..625607a 100644
--- a/Scrapy-release-procedure.md
+++ b/Scrapy-release-procedure.md
@@ -150,6 +150,7 @@ If you’ve released a patch version, you should cherry-pick the required commit
 
 To avoid the risk of CI suddenly failing and confusing pull request authors, we freeze some CI packages:
 
+- bandit
 - flake8
 - pylint
 - pytest-cov