diff --git a/History.md b/History.md
index 4dd5dd5af..320253a00 100644
--- a/History.md
+++ b/History.md
@@ -1,4 +1,8 @@
 
+5 Mar 2014, version 0.6.7
+
+- pin down express@3 version, since sinopia doesn't yet work with express@4
+
 28 Feb 2014, version 0.6.5
 
 - old SSL keys for npm are removed, solves `SELF_SIGNED_CERT_IN_CHAIN` error
diff --git a/package.yaml b/package.yaml
index 06bbf1641..8573b890c 100644
--- a/package.yaml
+++ b/package.yaml
@@ -18,7 +18,7 @@ bin:
   sinopia: ./bin/sinopia
 
 dependencies:
-  express: '^3.4.7'
+  express: '>= 3.4.7 < 4.0.0-0'
   commander: '>= 2.1.0'
   js-yaml: '>= 3.0.1'
   cookies: '>= 0.3.8'