diff --git a/pyproject.toml b/pyproject.toml
index 3481d666bacb..ff9a0bf3d25a 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -25,7 +25,7 @@ dependencies = [
   "django-crispy-forms>=1.14.0",
   "django-csp>=3.8",
   "django-pg-zero-downtime-migrations>=0.18",
-  "djangorestframework>=3.16.1",
+  "djangorestframework>=3.18.2",
   "drf-spectacular>=0.27.2",
   "emmett55>=1.3.0",
   "emmett-prometheus>=0.3.0",
@@ -325,6 +325,10 @@ filterwarnings = [
   # PyJWT 2.12.0 introduced InsecureKeyLengthWarning for HMAC keys shorter than
   # 32 bytes. Tests use short secrets intentionally; production secrets are long enough.
   "ignore:.*HMAC key.*below the minimum recommended length.*:jwt.warnings.InsecureKeyLengthWarning",
+
+  # DRF 3.18 deprecated the list-based ListSerializer error format; we keep it until
+  # callers handle the dict format (removed in DRF 3.20).
+  "ignore:The list-based error format for `ListSerializer` is deprecated.*:PendingDeprecationWarning",
 ]
 looponfailroots = ["src", "tests"]
 
diff --git a/src/sentry/conf/server.py b/src/sentry/conf/server.py
index 5555fbd6709d..9a7564775570 100644
--- a/src/sentry/conf/server.py
+++ b/src/sentry/conf/server.py
@@ -1440,6 +1440,7 @@ def SOCIAL_AUTH_DEFAULT_USERNAME() -> str:
     "DEFAULT_PERMISSION_CLASSES": ("sentry.api.permissions.NoPermission",),
     "EXCEPTION_HANDLER": "sentry.api.handlers.custom_exception_handler",
     "DEFAULT_SCHEMA_CLASS": "sentry.apidocs.schema.SentrySchema",
+    "LIST_SERIALIZER_ERRORS_AS_DICT": False,
 }
 
 
diff --git a/tests/sentry/api/test_authentication.py b/tests/sentry/api/test_authentication.py
index 00c81e5f145d..51849a49d7e1 100644
--- a/tests/sentry/api/test_authentication.py
+++ b/tests/sentry/api/test_authentication.py
@@ -782,6 +782,9 @@ class UrlInSignatureAuth(HmacSignatureAuthentication):
 
         # Signature without URL should fail
 
+        request = drf_request_from_request(
+            RequestFactory().post(url_path, data=data, content_type="application/json")
+        )
         signature_without_url = generate_service_request_signature(
             request.path_info,
             request.body,
diff --git a/uv.lock b/uv.lock
index 07b7c8372d4a..b3c2460ee948 100644
--- a/uv.lock
+++ b/uv.lock
@@ -375,13 +375,13 @@ wheels = [
 
 [[package]]
 name = "djangorestframework"
-version = "3.17.2"
+version = "3.18.2"
 source = { registry = "https://pypi.devinfra.sentry.io/simple" }
 dependencies = [
     { name = "django" },
 ]
 wheels = [
-    { url = "https://pypi.devinfra.sentry.io/wheels/djangorestframework-3.17.2-py3-none-any.whl", hash = "sha256:cb0546a7415d5b46c04e0f4fe0a54b2109f4fdd5e83ca773c8c6183a6493d042" },
+    { url = "https://pypi.devinfra.sentry.io/wheels/djangorestframework-3.18.2-py3-none-any.whl", hash = "sha256:a92d6a4e128a2550bd2fe2e02008a9e47fe52c180e130bb438f5ba70ee933a3f" },
 ]
 
 [[package]]
@@ -2368,7 +2368,7 @@ requires-dist = [
     { name = "django-crispy-forms", specifier = ">=1.14.0" },
     { name = "django-csp", specifier = ">=3.8" },
     { name = "django-pg-zero-downtime-migrations", specifier = ">=0.18" },
-    { name = "djangorestframework", specifier = ">=3.16.1" },
+    { name = "djangorestframework", specifier = ">=3.18.2" },
     { name = "drf-spectacular", specifier = ">=0.27.2" },
     { name = "emmett-prometheus", specifier = ">=0.3.0" },
     { name = "emmett-sentry", specifier = ">=0.9.0" },