diff --git a/global-requirements.txt b/global-requirements.txt
index ec9153e342..53d8ae20fb 100644
--- a/global-requirements.txt
+++ b/global-requirements.txt
@@ -236,7 +236,7 @@ pyparsing  # MIT
 pyroute2;sys_platform!='win32'  # Apache-2.0 (+ dual licensed GPL2)
 pysnmp  # BSD
 pystache  # MIT
-pysaml2!=4.0.3,!=4.0.4,!=4.0.5,!=4.0.5rc1,!=4.1.0,!=4.2.0,!=4.3.0,!=4.4.0  # Apache-2.0
+pysaml2!=4.0.3,!=4.0.4,!=4.0.5,!=4.0.5rc1,!=4.1.0,!=4.2.0,!=4.3.0,!=4.4.0,!=4.6.0  # Apache-2.0
 
 # OpenStack clients. None of these should have an upper bound
 # as that has implications for testing in the gate.
diff --git a/upper-constraints.txt b/upper-constraints.txt
index c1adb39cbb..6a5ce1db2a 100644
--- a/upper-constraints.txt
+++ b/upper-constraints.txt
@@ -353,7 +353,7 @@ openstack.nose-plugin===0.11
 os-collect-config===9.2.0
 python-qpid-proton===0.23.0
 python-octaviaclient===1.6.0
-pysaml2===4.6.0
+pysaml2===4.5.0
 requests-oauthlib===1.0.0
 oslo.reports===1.28.0
 ceilometermiddleware===1.3.0