diff --git a/appserver/distributions/glassfish/src/main/assembly/glassfish.xml b/appserver/distributions/glassfish/src/main/assembly/glassfish.xml
index 012263fcad4..c2ccd9a58a5 100644
--- a/appserver/distributions/glassfish/src/main/assembly/glassfish.xml
+++ b/appserver/distributions/glassfish/src/main/assembly/glassfish.xml
@@ -102,7 +102,7 @@
 
         <!-- javadb -->
         <fileSet>
-            <directory>${temp.dir}/derby/db-derby-${derby.version}-bin</directory>
+            <directory>${temp.dir}/derby/</directory>
             <excludes>
                 <exclude>demo/**</exclude>
                 <exclude>docs/**</exclude>
diff --git a/appserver/distributions/web/src/main/assembly/web.xml b/appserver/distributions/web/src/main/assembly/web.xml
index c092754dc0f..8cc170107e5 100644
--- a/appserver/distributions/web/src/main/assembly/web.xml
+++ b/appserver/distributions/web/src/main/assembly/web.xml
@@ -71,7 +71,7 @@
 
         <!-- javadb -->
         <fileSet>
-            <directory>${temp.dir}/derby/db-derby-${derby.version}-bin</directory>
+            <directory>${temp.dir}/derby/</directory>
             <excludes>
                 <exclude>demo/**</exclude>
                 <exclude>docs/**</exclude>
diff --git a/appserver/pom.xml b/appserver/pom.xml
index 426967e149a..43b07742778 100644
--- a/appserver/pom.xml
+++ b/appserver/pom.xml
@@ -111,7 +111,7 @@
         <dbschema.version>6.6</dbschema.version>
         <schema2beans.version>6.6</schema2beans.version>
         <mq.version>5.1.2-b01</mq.version>
-        <derby.version>10.13.1.1</derby.version>
+        <derby.version>10.13.1.2</derby.version>
         <weld.version>3.0.0.Final</weld.version>
         <wsdl4j.version>1.6.2</wsdl4j.version>
         <websocket-api.version>1.1</websocket-api.version>
diff --git a/appserver/tests/appserv-tests/devtests/transaction/ee/ee.xml b/appserver/tests/appserv-tests/devtests/transaction/ee/ee.xml
index cafe6f609e9..826b6c57f10 100644
--- a/appserver/tests/appserv-tests/devtests/transaction/ee/ee.xml
+++ b/appserver/tests/appserv-tests/devtests/transaction/ee/ee.xml
@@ -59,6 +59,8 @@
       <arg line="${env.S1AS_HOME}/databases"/>
       <arg line="--dbport"/>
       <arg line="${db.port}"/>
+      <arg line="--jvmoptions"/>
+      <arg line="'-Djava.security.manager -Djava.security.policy=${env.S1AS_HOME}/domains/domain1/config/server.policy'"/>
     </exec>
 </target>
 
@@ -193,4 +195,3 @@
       <param name="db.url" value="jdbc:derby://localhost:${db.port}/${db.name};create=true;"/>
     </antcall>
 </target>
-
diff --git a/nucleus/admin/template/src/main/resources/config/server.policy b/nucleus/admin/template/src/main/resources/config/server.policy
index 910da4e06a0..f4b300242b8 100644
--- a/nucleus/admin/template/src/main/resources/config/server.policy
+++ b/nucleus/admin/template/src/main/resources/config/server.policy
@@ -62,14 +62,14 @@ grant codeBase "file:${com.sun.aas.imqLib}/-" {
 grant codeBase "file:${com.sun.aas.derbyRoot}/lib/-" {
     permission java.lang.RuntimePermission "createClassLoader";
     permission java.io.FilePermission       "<<ALL FILES>>", "read,write";
-}; 
+};
 
 
 // permission for JDK's tools.jar to enable webservice annotation processing
-// at runtime by wsgen tool: 
+// at runtime by wsgen tool:
 //       permission java.lang.RuntimePermission "createClassLoader";
 //
-// permission for JDK's tools.jar to sign JARs at runtime for 
+// permission for JDK's tools.jar to sign JARs at runtime for
 // Java Web Start support:
 //       permissions java.security.AllPermission;
 // on the advice of the JDK tools folks.  Should be refined later.
@@ -102,7 +102,7 @@ grant {
     permission java.lang.RuntimePermission  "queuePrintJob";
     permission java.net.SocketPermission    "*", "connect";
 
-        // work-around for pointbase bug 4864405      
+        // work-around for pointbase bug 4864405
         permission java.io.FilePermission "${com.sun.aas.instanceRoot}${/}lib${/}databases${/}-", "delete";
         permission java.io.FilePermission "${java.io.tmpdir}${/}-", "delete";
 
@@ -111,12 +111,12 @@ grant {
     permission java.lang.RuntimePermission    "modifyThreadGroup";
     permission java.lang.RuntimePermission    "getClassLoader";
     permission java.lang.RuntimePermission    "setContextClassLoader";
-    permission javax.management.MBeanPermission "[com.sun.messaging.jms.*:*]", "*"; 
-   
-    // Following needed for CTS to pass with SM on, bug 16344201 
-    permission java.lang.RuntimePermission "closeClassLoader";                
-    permission java.io.SerializablePermission "enableSubstitution";            
-    permission java.security.SecurityPermission "getProperty.package.definition"; 
+    permission javax.management.MBeanPermission "[com.sun.messaging.jms.*:*]", "*";
+
+    // Following needed for CTS to pass with SM on, bug 16344201
+    permission java.lang.RuntimePermission "closeClassLoader";
+    permission java.io.SerializablePermission "enableSubstitution";
+    permission java.security.SecurityPermission "getProperty.package.definition";
 };
 
 // Following grant block is only required by Connectors. If Connectors
@@ -144,7 +144,9 @@ grant  codeBase "file:${com.sun.aas.instanceRoot}/applications/-"{
     permission java.io.FilePermission       "<<ALL FILES>>", "read,write";
     permission org.hibernate.validator.HibernateValidatorPermission "accessPrivateMembers";
 };
-//Added for changes proposed by Derby 10.12.1.1 (DERBY-6648)
+//Added for changes proposed by Derby 10.12.1.1 (DERBY-6648) and Derby 10.14.2.0
 grant {
      permission org.apache.derby.security.SystemPermission "engine", "usederbyinternals";
+     permission java.io.FilePermission       "<<ALL FILES>>", "write,read";
+     permission java.security.AllPermission;
 };