diff --git a/requirements.txt b/requirements.txt
index 71156db3af..b72f380e66 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -110,7 +110,9 @@ werkzeug==1.0.1
     #   flask
     #   flask-jwt-extended
 wtforms==2.3.3
-    # via flask-wtf
+    # via
+    #   Flask-AppBuilder (setup.py)
+    #   flask-wtf
 zipp==3.5.0
     # via importlib-metadata
 
diff --git a/setup.py b/setup.py
index 7f6ff06003..75e47cdef0 100644
--- a/setup.py
+++ b/setup.py
@@ -66,6 +66,7 @@ def desc():
         "prison>=0.2.1, <1.0.0",
         "PyJWT>=1.7.1, <2.0.0",
         "sqlalchemy-utils>=0.32.21, <1",
+        "WTForms<3.0.0",
     ],
     extras_require={
         "jmespath": ["jmespath>=0.9.5"],