diff --git a/service/src/main/java/org/whispersystems/textsecuregcm/entities/ReserveUsernameHashRequest.java b/service/src/main/java/org/whispersystems/textsecuregcm/entities/ReserveUsernameHashRequest.java
index 4d25312ff..be37a9197 100644
--- a/service/src/main/java/org/whispersystems/textsecuregcm/entities/ReserveUsernameHashRequest.java
+++ b/service/src/main/java/org/whispersystems/textsecuregcm/entities/ReserveUsernameHashRequest.java
@@ -11,10 +11,12 @@ import com.fasterxml.jackson.databind.annotation.JsonSerialize;
 import org.whispersystems.textsecuregcm.controllers.AccountController;
 import org.whispersystems.textsecuregcm.util.ByteArrayBase64UrlAdapter;
 import javax.validation.Valid;
+import javax.validation.constraints.NotNull;
 import javax.validation.constraints.Size;
 import java.util.List;
 
 public record ReserveUsernameHashRequest(
+    @NotNull
     @Valid
     @Size(min=1, max=AccountController.MAXIMUM_USERNAME_HASHES_LIST_LENGTH)
     @JsonSerialize(contentUsing = ByteArrayBase64UrlAdapter.Serializing.class)
diff --git a/service/src/test/java/org/whispersystems/textsecuregcm/controllers/AccountControllerTest.java b/service/src/test/java/org/whispersystems/textsecuregcm/controllers/AccountControllerTest.java
index da28e4ebb..760c1096e 100644
--- a/service/src/test/java/org/whispersystems/textsecuregcm/controllers/AccountControllerTest.java
+++ b/service/src/test/java/org/whispersystems/textsecuregcm/controllers/AccountControllerTest.java
@@ -1722,6 +1722,17 @@ class AccountControllerTest {
     assertThat(response.getStatus()).isEqualTo(422);
   }
 
+  @Test
+  void testReserveUsernameHashNullList() {
+    Response response =
+        resources.getJerseyTest()
+            .target("/v1/accounts/username_hash/reserve")
+            .request()
+            .header("Authorization", AuthHelper.getAuthHeader(AuthHelper.VALID_UUID, AuthHelper.VALID_PASSWORD))
+            .put(Entity.json(new ReserveUsernameHashRequest(null)));
+    assertThat(response.getStatus()).isEqualTo(422);
+  }
+
   @Test
   void testReserveUsernameHashInvalidBase64UrlEncoding() {
     Response response =