diff --git a/changelog.d/12444.misc b/changelog.d/12444.misc
new file mode 100644
index 000000000000..4643a155a940
--- /dev/null
+++ b/changelog.d/12444.misc
@@ -0,0 +1 @@
+Explicitly specify the `tls` extra for Twisted dependency.
diff --git a/poetry.lock b/poetry.lock
index 17430cbfa6c1..bbe8eba96d40 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -1587,13 +1587,13 @@ redis = ["txredisapi", "hiredis"]
 saml2 = ["pysaml2"]
 sentry = ["sentry-sdk"]
 systemd = ["systemd-python"]
-test = ["parameterized"]
+test = ["parameterized", "idna"]
 url_preview = ["lxml"]
 
 [metadata]
 lock-version = "1.1"
 python-versions = "^3.7"
-content-hash = "7ff6d982a9d6675cb595b216b23549ef1942d0e39cb91c97494ff6ed95a9e8d2"
+content-hash = "964ad29eaf7fd02749a4e735818f3bc0ba729c2f4b9e3213f0daa02643508b16"
 
 [metadata.files]
 appdirs = [
diff --git a/pyproject.toml b/pyproject.toml
index d44fcf41926d..2a3637a7f02f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -114,12 +114,11 @@ canonicaljson = ">=1.4.0"
 # we use the type definitions added in signedjson 1.1.
 signedjson = ">=1.1.0"
 PyNaCl = ">=1.2.1"
-idna = ">=2.5"
 # validating SSL certs for IP addresses requires service_identity 18.1.
 service-identity = ">=18.1.0"
 # Twisted 18.9 introduces some logger improvements that the structured
 # logger utilises
-Twisted = ">=18.9.0"
+Twisted = {extras = ["tls"], version = ">=18.9.0"}
 treq = ">=15.1"
 # Twisted has required pyopenssl 16.0 since about Twisted 16.6.
 pyOpenSSL = ">=16.0.0"
@@ -180,6 +179,7 @@ txredisapi = { version = ">=1.4.7", optional = true }
 hiredis = { version = "*", optional = true }
 Pympler = { version = "*", optional = true }
 parameterized = { version = ">=0.7.4", optional = true }
+idna = { version = ">=2.5", optional = true }
 
 [tool.poetry.extras]
 # NB: Packages that should be part of `pip install matrix-synapse[all]` need to be specified
@@ -201,7 +201,7 @@ jwt = ["pyjwt"]
 redis = ["txredisapi", "hiredis"]
 # Required to use experimental `caches.track_memory_usage` config option.
 cache_memory = ["pympler"]
-test = ["parameterized"]
+test = ["parameterized", "idna"]
 
 # The duplication here is awful. I hate hate hate hate hate it. However, for now I want
 # to ensure you can still `pip install matrix-synapse[all]` like today. Two motivations:
@@ -266,6 +266,7 @@ types-setuptools = ">=57.4.0"
 # parameterized<0.7.4 can create classes with names that would normally be invalid
 # identifiers. trial really does not like this when running with multiple workers.
 parameterized = ">=0.7.4"
+idna = ">=2.5"
 
 # The following are used by the release script
 click = "==8.1.0"
@@ -280,4 +281,4 @@ towncrier = ">=18.6.0rc1"
 
 [build-system]
 requires = ["setuptools"]
-build-backend = "setuptools.build_meta"
\ No newline at end of file
+build-backend = "setuptools.build_meta"
diff --git a/setup.py b/setup.py
index 48bd418bb83a..ecd30247ed6b 100755
--- a/setup.py
+++ b/setup.py
@@ -120,7 +120,7 @@ def exec_file(path_segments):
 # Tests assume that all optional dependencies are installed.
 #
 # parameterized_class decorator was introduced in parameterized 0.7.0
-CONDITIONAL_REQUIREMENTS["test"] = ["parameterized>=0.7.0"]
+CONDITIONAL_REQUIREMENTS["test"] = ["parameterized>=0.7.0", "idna>=2.5"]
 
 CONDITIONAL_REQUIREMENTS["dev"] = (
     CONDITIONAL_REQUIREMENTS["lint"]
diff --git a/synapse/python_dependencies.py b/synapse/python_dependencies.py
index 8bd91d5f727e..ec199a161db8 100644
--- a/synapse/python_dependencies.py
+++ b/synapse/python_dependencies.py
@@ -50,12 +50,11 @@
     # we use the type definitions added in signedjson 1.1.
     "signedjson>=1.1.0",
     "pynacl>=1.2.1",
-    "idna>=2.5",
     # validating SSL certs for IP addresses requires service_identity 18.1.
     "service_identity>=18.1.0",
     # Twisted 18.9 introduces some logger improvements that the structured
     # logger utilises
-    "Twisted>=18.9.0",
+    "Twisted[tls]>=18.9.0",
     "treq>=15.1",
     # Twisted has required pyopenssl 16.0 since about Twisted 16.6.
     "pyopenssl>=16.0.0",