diff --git a/setup/requirements.txt b/setup/requirements.txt
index b6bf2120..f2eb2157 100644
--- a/setup/requirements.txt
+++ b/setup/requirements.txt
@@ -1,4 +1,4 @@
-flask
-flask-bootstrap
-redis
-gunicorn
+Flask==1.0.2
+Flask-Bootstrap==3.3.7.1
+gunicorn==19.9.0
+redis==3.2.1
diff --git a/setup/templates/steps/compose/02_services.html b/setup/templates/steps/compose/02_services.html
index 20d4d7cb..5118c304 100644
--- a/setup/templates/steps/compose/02_services.html
+++ b/setup/templates/steps/compose/02_services.html
@@ -59,7 +59,7 @@ the security implications caused by such an increase of attack surface.<p>
   <i>Fetchmail allows users to retrieve mail from an external mail-server via IMAP/POP3 and puts it in their inbox.</i>
 </div>
 
-<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
+<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js"></script>
 
 <script type="text/javascript" src="{{ url_for('static', filename='render.js') }}"></script>
 
diff --git a/setup/templates/steps/config.html b/setup/templates/steps/config.html
index 29d8dddd..3769a210 100644
--- a/setup/templates/steps/config.html
+++ b/setup/templates/steps/config.html
@@ -83,7 +83,7 @@ manage your email domains, users, etc.</p>
     <input class="form-control" type="text" name="admin_path" id="admin_path" style="display: none">
 </div>
 
-<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
+<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js"></script>
 
 <script type="text/javascript" src="{{ url_for('static', filename='render.js') }}"></script>
 
diff --git a/setup/templates/steps/stack/02_services.html b/setup/templates/steps/stack/02_services.html
index 3f5186b0..6fce0ae6 100644
--- a/setup/templates/steps/stack/02_services.html
+++ b/setup/templates/steps/stack/02_services.html
@@ -55,7 +55,7 @@ the security implications caused by such an increase of attack surface.<p>
   <i>Fetchmail allows users to retrieve mail from an external mail-server via IMAP/POP3 and puts it in their inbox.</i>
 </div>
 
-<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
+<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js"></script>
 
 <script type="text/javascript" src="{{ url_for('static', filename='render.js') }}"></script>
 
diff --git a/towncrier/newsfragments/1880.feature b/towncrier/newsfragments/1880.feature
new file mode 100644
index 00000000..212dc906
--- /dev/null
+++ b/towncrier/newsfragments/1880.feature
@@ -0,0 +1 @@
+Update jquery used in setup. Set pinned versions in requirements.txt for setup. This is a security update.