diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index 7cfd3eb8a5..e4f3b786cf 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -10,7 +10,7 @@ Added
 * Continue introducing `pants <https://www.pantsbuild.org/docs>`_ to improve DX (Developer Experience)
   working on StackStorm, improve our security posture, and improve CI reliability thanks in part
   to pants' use of PEX lockfiles. This is not a user-facing addition.
-  #5778 #5789 #5817 #5795 #5830 #5833 #5834 #5841
+  #5778 #5789 #5817 #5795 #5830 #5833 #5834 #5841 #5840
   Contributed by @cognifloyd
 
 
diff --git a/lockfiles/setuptools.lock b/lockfiles/setuptools.lock
new file mode 100644
index 0000000000..ab6cefa08d
--- /dev/null
+++ b/lockfiles/setuptools.lock
@@ -0,0 +1,120 @@
+// This lockfile was autogenerated by Pants. To regenerate, run:
+//
+//    ./pants generate-lockfiles --resolve=setuptools
+//
+// --- BEGIN PANTS LOCKFILE METADATA: DO NOT EDIT OR REMOVE ---
+// {
+//   "version": 3,
+//   "valid_for_interpreter_constraints": [
+//     "CPython<3.9,>=3.6"
+//   ],
+//   "generated_with_requirements": [
+//     "setuptools<59.0,>=50.3.0",
+//     "wheel<0.38,>=0.35.1"
+//   ],
+//   "manylinux": "manylinux2014",
+//   "requirement_constraints": [],
+//   "only_binary": [],
+//   "no_binary": []
+// }
+// --- END PANTS LOCKFILE METADATA ---
+
+{
+  "allow_builds": true,
+  "allow_prereleases": false,
+  "allow_wheels": true,
+  "build_isolation": true,
+  "constraints": [],
+  "locked_resolves": [
+    {
+      "locked_requirements": [
+        {
+          "artifacts": [
+            {
+              "algorithm": "sha256",
+              "hash": "a481fbc56b33f5d8f6b33dce41482e64c68b668be44ff42922903b03872590bf",
+              "url": "https://files.pythonhosted.org/packages/70/e9/84e2865fddfaba4506bc5d293d2a535bf27e31b12ca16d31564f8ce28cdb/setuptools-58.5.3-py3-none-any.whl"
+            },
+            {
+              "algorithm": "sha256",
+              "hash": "dae6b934a965c8a59d6d230d3867ec408bb95e73bd538ff77e71fedf1eaca729",
+              "url": "https://files.pythonhosted.org/packages/1e/00/05f51ceab8d3b9be4295000d8be4c830c53e5477755888994e9825606cd9/setuptools-58.5.3.tar.gz"
+            }
+          ],
+          "project_name": "setuptools",
+          "requires_dists": [
+            "flake8-2020; extra == \"testing\"",
+            "furo; extra == \"docs\"",
+            "jaraco.envs; extra == \"testing\"",
+            "jaraco.packaging>=8.2; extra == \"docs\"",
+            "jaraco.path>=3.2.0; extra == \"testing\"",
+            "jaraco.tidelift>=1.4; extra == \"docs\"",
+            "mock; extra == \"testing\"",
+            "paver; extra == \"testing\"",
+            "pip>=19.1; extra == \"testing\"",
+            "pygments-github-lexers==0.0.5; extra == \"docs\"",
+            "pytest-black>=0.3.7; platform_python_implementation != \"PyPy\" and extra == \"testing\"",
+            "pytest-checkdocs>=2.4; extra == \"testing\"",
+            "pytest-cov; extra == \"testing\"",
+            "pytest-enabler>=1.0.1; extra == \"testing\"",
+            "pytest-flake8; extra == \"testing\"",
+            "pytest-mypy; platform_python_implementation != \"PyPy\" and extra == \"testing\"",
+            "pytest-virtualenv>=1.2.7; extra == \"testing\"",
+            "pytest-xdist; extra == \"testing\"",
+            "pytest>=6; extra == \"testing\"",
+            "rst.linker>=1.9; extra == \"docs\"",
+            "sphinx-inline-tabs; extra == \"docs\"",
+            "sphinx; extra == \"docs\"",
+            "sphinx; extra == \"testing\"",
+            "sphinxcontrib-towncrier; extra == \"docs\"",
+            "virtualenv>=13.0.0; extra == \"testing\"",
+            "wheel; extra == \"testing\""
+          ],
+          "requires_python": ">=3.6",
+          "version": "58.5.3"
+        },
+        {
+          "artifacts": [
+            {
+              "algorithm": "sha256",
+              "hash": "4bdcd7d840138086126cd09254dc6195fb4fc6f01c050a1d7236f2630db1d22a",
+              "url": "https://files.pythonhosted.org/packages/27/d6/003e593296a85fd6ed616ed962795b2f87709c3eee2bca4f6d0fe55c6d00/wheel-0.37.1-py2.py3-none-any.whl"
+            },
+            {
+              "algorithm": "sha256",
+              "hash": "e9a504e793efbca1b8e0e9cb979a249cf4a0a7b5b8c9e8b65a5e39d49529c1c4",
+              "url": "https://files.pythonhosted.org/packages/c0/6c/9f840c2e55b67b90745af06a540964b73589256cb10cc10057c87ac78fc2/wheel-0.37.1.tar.gz"
+            }
+          ],
+          "project_name": "wheel",
+          "requires_dists": [
+            "pytest-cov; extra == \"test\"",
+            "pytest>=3.0.0; extra == \"test\""
+          ],
+          "requires_python": "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,>=2.7",
+          "version": "0.37.1"
+        }
+      ],
+      "platform_tag": null
+    }
+  ],
+  "path_mappings": {},
+  "pex_version": "2.1.108",
+  "pip_version": "20.3.4-patched",
+  "prefer_older_binary": false,
+  "requirements": [
+    "setuptools<59.0,>=50.3.0",
+    "wheel<0.38,>=0.35.1"
+  ],
+  "requires_python": [
+    "<3.9,>=3.6"
+  ],
+  "resolver_version": "pip-2020-resolver",
+  "style": "universal",
+  "target_systems": [
+    "linux",
+    "mac"
+  ],
+  "transitive": true,
+  "use_pep517": null
+}
diff --git a/pants.toml b/pants.toml
index ecc243b257..01b415bd60 100644
--- a/pants.toml
+++ b/pants.toml
@@ -147,6 +147,11 @@ config = "lint-configs/python/.flake8"
 [regex-lint]
 config = "@lint-configs/regex-lint.yaml"
 
+[setuptools]
+# setuptools 59.7 (at least) does not support python 3.6
+version = "setuptools>=50.3.0,<59.0"
+lockfile = "lockfiles/setuptools.lock"
+
 [twine]
 lockfile = "lockfiles/twine.lock"
 version = "twine>=3.7.1,<3.8"