diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6a7400e7..3dbab341 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,11 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.4.2]
+
+### Fixed
+- error in register-files endpoint when labs is a list
+
 ## [3.4.1]
 
 ### Modified
diff --git a/alyx/alyx/__init__.py b/alyx/alyx/__init__.py
index 9d307c8f..823f7939 100644
--- a/alyx/alyx/__init__.py
+++ b/alyx/alyx/__init__.py
@@ -1 +1 @@
-VERSION = __version__ = '3.4.1'
+VERSION = __version__ = '3.4.2'
diff --git a/alyx/data/tests_rest.py b/alyx/data/tests_rest.py
index f1575867..71fb614e 100644
--- a/alyx/data/tests_rest.py
+++ b/alyx/data/tests_rest.py
@@ -259,6 +259,9 @@ def test_register_files(self):
                 'hostname': 'hostname',
                 'labs': ['laba'],
                 }
+        # NB: After serialization and deserialization, labs ends up as a str in this test,
+        # however ONE REST requests appear to serialize differently, with labs remaining as
+        # a list. Both lists and comma separated strings must be supported
         r = self.client.post(reverse('register-file'), data)
         self.ar(r, 201)
         fr = FileRecord.objects.filter(dataset=Dataset.objects.get(name='a.a.e1'))
diff --git a/alyx/data/views.py b/alyx/data/views.py
index b65ce05f..aa055170 100644
--- a/alyx/data/views.py
+++ b/alyx/data/views.py
@@ -523,9 +523,13 @@ def create(self, request):
             check_protected = check_protected == 'True'
 
         # Multiple labs (NB: projects is an alias of labs)
-        labs = request.data.get('labs', '').split(',')
-        labs += request.data.get('projects', '').split(',')
-        labs = [Lab.objects.get(name=lab) for lab in labs if lab]
+        labs = request.data.get('labs', [])
+        if isinstance(labs, str):
+            labs = labs.split(',')
+        projects = request.data.get('projects', [])
+        if isinstance(projects, str):
+            projects = projects.split(',')
+        labs = [Lab.objects.get(name=lab) for lab in labs + projects if lab]
         repositories = _get_repositories_for_labs(labs or [subject.lab], server_only=server_only)
         if repo and repo not in repositories:
             repositories += [repo]
diff --git a/requirements_frozen.txt b/requirements_frozen.txt
index 5cf20124..bc19880a 100644
--- a/requirements_frozen.txt
+++ b/requirements_frozen.txt
@@ -11,7 +11,7 @@ coreapi==2.3.3
 coreschema==0.0.4
 coverage==7.8.2
 coveralls==4.0.1
-cryptography==45.0.3
+cryptography==46.0.5
 cycler==0.12.1
 Django==5.2.11
 django-admin-list-filter-dropdown==1.0.3
@@ -52,7 +52,7 @@ numpy==2.2.6
 ONE-api==3.1.1
 packaging==25.0
 pandas==2.2.3
-pillow==11.2.1
+pillow==12.1.1
 psycopg2-binary==2.9.10
 pyarrow==20.0.0
 pycodestyle==2.13.0
@@ -70,7 +70,7 @@ ruff==0.11.11
 s3transfer==0.13.0
 setuptools==80.9.0
 six==1.17.0
-sqlparse==0.5.3
+sqlparse==0.5.4
 structlog==25.3.0
 tqdm==4.67.1
 tzdata==2025.2