diff --git a/fixed-requirements.txt b/fixed-requirements.txt
index 00ed7297b94..8a3a03aa866 100644
--- a/fixed-requirements.txt
+++ b/fixed-requirements.txt
@@ -12,7 +12,7 @@ cryptography==39.0.1
 # depend on rely
 eventlet==0.33.3
 flex==6.14.1
-gitpython==3.1.15
+gitpython<=3.1.37
 # Needed by gitpython, old versions used to bundle it
 gitdb==4.0.2
 # Note: greenlet is used by eventlet
diff --git a/requirements.txt b/requirements.txt
index 841cf38cb34..b4d4fafd6ec 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -20,7 +20,7 @@ dnspython>=1.16.0,<2.0.0
 eventlet==0.33.3
 flex==6.14.1
 gitdb==4.0.2
-gitpython==3.1.15
+gitpython<=3.1.37
 greenlet==1.0.0
 gunicorn==21.2.0
 importlib-metadata==3.10.1
diff --git a/st2actions/requirements.txt b/st2actions/requirements.txt
index e15c7c967e2..bdfe4e8b1ce 100644
--- a/st2actions/requirements.txt
+++ b/st2actions/requirements.txt
@@ -9,7 +9,7 @@ MarkupSafe<2.1.0,>=0.23
 apscheduler==3.7.0
 chardet<3.1.0
 eventlet==0.33.3
-gitpython==3.1.15
+gitpython<=3.1.37
 jinja2==2.11.3
 kombu==5.0.2
 lockfile==0.12.2
diff --git a/st2common/requirements.txt b/st2common/requirements.txt
index bd1a1827af9..1d4b86fc829 100644
--- a/st2common/requirements.txt
+++ b/st2common/requirements.txt
@@ -17,7 +17,7 @@ dnspython>=1.16.0,<2.0.0
 eventlet==0.33.3
 flex==6.14.1
 gitdb==4.0.2
-gitpython==3.1.15
+gitpython<=3.1.37
 greenlet==1.0.0
 jinja2==2.11.3
 jsonpath-rw==1.4.0