diff --git a/tox.ini b/tox.ini
index 219a2b616..c880b71fc 100644
--- a/tox.ini
+++ b/tox.ini
@@ -232,7 +232,12 @@ deps =
     pyOpenSSL==24.3.0
     queuelib==1.4.2
     service_identity==18.1.0
-    w3lib==1.20.0
+    # w3lib 1.17 fails to import on PyPy 3.11 because its encoding regex uses
+    # an inline flag placement that Python 3.11 treats as an error: global
+    # flags not at the start of the expression. w3lib 1.18 stopped encoding []
+    # in URLs until 2.1.0 brought that behavior back. Tests for verbatim_url
+    # rely on that encoding.
+    w3lib==2.1.0
     zope.interface==5.1.0
 commands =
     ; disabling coverage