diff --git a/vcpkg.json b/vcpkg.json
index d84f590c1b..138e09a83c 100644
--- a/vcpkg.json
+++ b/vcpkg.json
@@ -62,6 +62,11 @@
     {
       "name": "ngspice",
       "version": "42"
+    },
+    {
+      "name": "liblzma",
+      "version": "5.4.4",
+      "$comment": "liblzma & xz were compromised upstream: CVE-2024-3094."
     }
   ]
 }