diff --git a/test-utils/src/dev/db.rs b/test-utils/src/dev/db.rs
index d4e8b8d0992..fe636f09272 100644
--- a/test-utils/src/dev/db.rs
+++ b/test-utils/src/dev/db.rs
@@ -620,11 +620,11 @@ fn make_pg_config(
 ) -> Result<PostgresConfigWithUrl, anyhow::Error> {
     // TODO-design This is really irritating.
     //
-    // CockroachDB reports a listen URL that does not specify a database to
-    // connect to.  (This makes sense.)  But we want to expose a client URL that
-    // does specify a database (since `CockroachInstance` essentially hardcodes
-    // a specific database name (via dbinit.sql and has_omicron_schema())) and
-    // user.
+    // Recent versions of CockroachDB report a listen URL that specifies a
+    // specific database to connect to, which is not our database.  (This is
+    // fine.)  But we want to expose a client URL that specifies the omicron
+    // database (since `CockroachInstance` essentially hardcodes a specific
+    // database name (via dbinit.sql and has_omicron_schema())) and user.
     //
     // We can parse the listen URL here into a tokio_postgres::Config, then use
     // methods on that struct to modify it as needed.  But if we do that, we'd
@@ -661,7 +661,6 @@ fn make_pg_config(
         pg_config.get_connect_timeout().map(|_| "connect_timeout"),
         pg_config.get_options().map(|_| "options"),
         pg_config.get_password().map(|_| "password"),
-        pg_config.get_dbname().map(|_| "dbname"),
     ];
 
     let unsupported_values =
@@ -675,6 +674,20 @@ fn make_pg_config(
         );
     }
 
+    if let Some(dbname) = pg_config.get_dbname() {
+        if dbname != "defaultdb" {
+            // Again, we're just checking our assumptions about CockroachDB
+            // here.  If we somehow found a different database name here, it'd
+            // be good to understand why and whether it's correct to just
+            // replace it below.
+            bail!(
+                "unsupported PostgreSQL listen URL (unexpected database name \
+                other than \"defaultdb\"): {:?}",
+                listen_url
+            )
+        }
+    }
+
     // As a side note: it's rather absurd that the default configuration enables
     // keepalives with a two-hour timeout.  In most networking stacks,
     // keepalives are disabled by default.  If you enable them and don't specify
@@ -740,7 +753,7 @@ pub async fn has_omicron_schema(client: &tokio_postgres::Client) -> bool {
                 e.code().expect("got non-SQL error checking for schema");
             assert_eq!(
                 *sql_error,
-                tokio_postgres::error::SqlState::UNDEFINED_TABLE
+                tokio_postgres::error::SqlState::UNDEFINED_DATABASE
             );
             false
         }
@@ -1190,7 +1203,7 @@ mod test {
         eprintln!("found error: {}", error);
         assert!(error.contains("unsupported PostgreSQL listen URL"));
 
-        // unexpected contents in initial listen URL
+        // unexpected contents in initial listen URL (wrong db name)
         let error = make_pg_config(
             "postgresql://root@127.0.0.1:45913/foobar?sslmode=disable",
         )
@@ -1199,7 +1212,19 @@ mod test {
         eprintln!("found error: {}", error);
         assert!(error.contains(
             "unsupported PostgreSQL listen URL \
-            (did not expect any of these fields: dbname)"
+            (unexpected database name other than \"defaultdb\"): "
+        ));
+
+        // unexpected contents in initial listen URL (extra param)
+        let error = make_pg_config(
+            "postgresql://root@127.0.0.1:45913/foobar?application_name=foo",
+        )
+        .unwrap_err()
+        .to_string();
+        eprintln!("found error: {}", error);
+        assert!(error.contains(
+            "unsupported PostgreSQL listen URL \
+            (did not expect any of these fields: application_name)"
         ));
     }
 }
diff --git a/tools/cockroachdb_checksums b/tools/cockroachdb_checksums
index aba650a9b5d..4f8edae3bad 100644
--- a/tools/cockroachdb_checksums
+++ b/tools/cockroachdb_checksums
@@ -1,3 +1,3 @@
-CIDL_MD5_DARWIN="cab1998101cc7138c52c312aff0776dc"
-CIDL_MD5_LINUX="d0aab99810ddf37b2f6d183077df262d"
-CIDL_MD5_ILLUMOS="499b7f9a80028c993b87808556c29425"
+CIDL_MD5_DARWIN="1074a0946f57b65331a3a5723e068645"
+CIDL_MD5_LINUX="50348e9a4e48d4a6ef973650a9edf09d"
+CIDL_MD5_ILLUMOS="7efc03b988983e3f1829814c48553822"
diff --git a/tools/cockroachdb_version b/tools/cockroachdb_version
index 162a680ad02..d44d5b1b7cb 100644
--- a/tools/cockroachdb_version
+++ b/tools/cockroachdb_version
@@ -1 +1 @@
-v21.1.10
+v21.2.9