diff --git a/changelog.d/8898.misc b/changelog.d/8898.misc
new file mode 100644
index 000000000..bdb0d40d5
--- /dev/null
+++ b/changelog.d/8898.misc
@@ -0,0 +1 @@
+Add a maximum version for pysaml2 on Python 3.5.
diff --git a/synapse/python_dependencies.py b/synapse/python_dependencies.py
index c899ca14d..c97e0df1f 100644
--- a/synapse/python_dependencies.py
+++ b/synapse/python_dependencies.py
@@ -96,7 +96,11 @@ CONDITIONAL_REQUIREMENTS = {
         # python 3.5.2, as per https://github.com/itamarst/eliot/issues/418
         'eliot<1.8.0;python_version<"3.5.3"',
     ],
-    "saml2": ["pysaml2>=4.5.0"],
+    "saml2": [
+        # pysaml2 6.4.0 is incompatible with Python 3.5 (see https://github.com/IdentityPython/pysaml2/issues/749)
+        "pysaml2>=4.5.0,<6.4.0;python_version<'3.6'",
+        "pysaml2>=4.5.0;python_version>='3.6'",
+    ],
     "oidc": ["authlib>=0.14.0"],
     "systemd": ["systemd-python>=231"],
     "url_preview": ["lxml>=3.5.0"],