diff --git a/Dockerfile b/Dockerfile
index ee3722c1..102d69bb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -34,7 +34,7 @@ RUN --mount=type=cache,id=m2_repo,target=/root/.m2/repository \
     && find target -maxdepth 1 -type d -name 'ERDDAP-*' -exec mv {} target/ERDDAP \;
 
 # Run the built erddap war via a tomcat instance
-FROM tomcat:10.1.19-jdk21-temurin-jammy
+FROM tomcat:10.1.39-jdk21-temurin-jammy
 
 RUN apt-get update && apt-get install -y \
     gosu \
diff --git a/src/test/java/gov/noaa/pfel/erddap/dataset/EDDTableFromErddapTests.java b/src/test/java/gov/noaa/pfel/erddap/dataset/EDDTableFromErddapTests.java
index c7d711a4..296528aa 100644
--- a/src/test/java/gov/noaa/pfel/erddap/dataset/EDDTableFromErddapTests.java
+++ b/src/test/java/gov/noaa/pfel/erddap/dataset/EDDTableFromErddapTests.java
@@ -409,6 +409,7 @@ void testQuotes() throws Throwable {
    * 2016-10-03 to deal with this problem.
    */
   @org.junit.jupiter.api.Test
+  @TagExternalERDDAP
   void testChukchiSea() throws Throwable {
     // testVerboseOn();
     int language = 0;
diff --git a/src/test/java/jetty/JettyTests.java b/src/test/java/jetty/JettyTests.java
index bf8dadd9..f68f6fd1 100644
--- a/src/test/java/jetty/JettyTests.java
+++ b/src/test/java/jetty/JettyTests.java
@@ -6625,6 +6625,8 @@ void testForBrokenLinks(String tUrl) throws Exception {
           // (temporary?) early 2025
           // pcreview site down early 2025
           "https://www.pcreview.co.uk/threads/datetime-accounts-for-leap-seconds.1357623/",
+          // site returns 403 in test, but works in browser
+          "https://www.cnmoc.usff.navy.mil/Our-Commands/United-States-Naval-Observatory/Precise-Time-Department/The-USNO-Master-Clock/Definitions-of-Systems-of-Time/",
         };
     // https://unitsofmeasure.org/ucum.html fails in tests because of certificate,
     // but succeeds in my browser. Others are like this, too.