diff --git a/pyproject.toml b/pyproject.toml
index 0dcbade90..07e882c93 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -21,7 +21,7 @@ dependencies = [
     "queuelib>=1.6.1",
     "service_identity>=23.1.0",
     "tldextract",
-    "w3lib>=1.17.0",
+    "w3lib>=2.1.0",
     "zope.interface>=5.1.0",
     # Platform-specific dependencies
     'PyDispatcher>=2.0.5; platform_python_implementation == "CPython"',
diff --git a/tox.ini b/tox.ini
index c56ad011b..afcc73d46 100644
--- a/tox.ini
+++ b/tox.ini
@@ -145,7 +145,7 @@ deps =
     pyOpenSSL==22.0.0
     queuelib==1.6.1
     service_identity==23.1.0
-    w3lib==1.17.0
+    w3lib==2.1.0
     zope.interface==5.1.0
     {[test-requirements]deps}
 setenv =
@@ -263,11 +263,6 @@ deps =
     pyOpenSSL==24.3.0
     queuelib==1.6.1
     service_identity==23.1.0
-    # w3lib 1.17 fails to import on PyPy 3.11 because its encoding regex uses
-    # an inline flag placement that Python 3.11 treats as an error: global
-    # flags not at the start of the expression. w3lib 1.18 stopped encoding []
-    # in URLs until 2.1.0 brought that behavior back. Tests for verbatim_url
-    # rely on that encoding.
     w3lib==2.1.0
     zope.interface==5.1.0
 commands =