diff --git a/dev-tools/omdb/src/bin/omdb/db.rs b/dev-tools/omdb/src/bin/omdb/db.rs
index d7f8af04f8f..63628e5e86e 100644
--- a/dev-tools/omdb/src/bin/omdb/db.rs
+++ b/dev-tools/omdb/src/bin/omdb/db.rs
@@ -173,6 +173,8 @@ use std::future::Future;
 use std::net::Ipv4Addr;
 use std::net::Ipv6Addr;
 use std::num::NonZeroU32;
+use std::os::unix::process::CommandExt;
+use std::process::Command;
 use std::str::FromStr;
 use std::sync::Arc;
 use tabled::Tabled;
@@ -351,6 +353,8 @@ pub struct DbFetchOptions {
 /// Subcommands that query or update the database
 #[derive(Debug, Subcommand, Clone)]
 enum DbCommands {
+    /// Launch `cockroach-sql`
+    Sql,
     /// Print information about blueprints
     ///
     /// Most blueprint information is available via `omdb nexus`, not `omdb db`.
@@ -1155,10 +1159,21 @@ impl DbArgs {
         omdb: &Omdb,
         log: &slog::Logger,
     ) -> Result<(), anyhow::Error> {
+        if let DbCommands::Sql = &self.command {
+            let url = self.db_url_opts.resolve_pg_url(omdb, log).await?;
+            let url = url.url().split(',').next().unwrap_or(url.url());
+            let mut command =
+                Command::new("/opt/oxide/cockroachdb/bin/cockroach-sql");
+            let error = command.args(["--url", url]).exec();
+            return Err(error)
+                .with_context(|| format!("failed to exec {command:?}"));
+        }
+
         let fetch_opts = &self.fetch_opts;
         self.db_url_opts.with_datastore(omdb, log, |opctx, datastore| {
             async move {
                 match &self.command {
+                    DbCommands::Sql => unreachable!(),
                     DbCommands::Blueprints(args) => {
                         cmd_db_blueprints(&opctx, &datastore, &fetch_opts, &args).await
                     }
diff --git a/nexus-config/src/postgres_config.rs b/nexus-config/src/postgres_config.rs
index e9f57ea3f4f..0531edda530 100644
--- a/nexus-config/src/postgres_config.rs
+++ b/nexus-config/src/postgres_config.rs
@@ -30,8 +30,8 @@ pub struct PostgresConfigWithUrl {
 }
 
 impl PostgresConfigWithUrl {
-    pub fn url(&self) -> String {
-        self.url_raw.clone()
+    pub fn url(&self) -> &str {
+        &self.url_raw
     }
 
     /// Accesses the first ip / port pair within the URL.
diff --git a/package-manifest.toml b/package-manifest.toml
index e8cf598305b..a54817f4397 100644
--- a/package-manifest.toml
+++ b/package-manifest.toml
@@ -108,6 +108,7 @@ source.type = "composite"
 source.packages = [
   "omicron-nexus.tar.gz",
   "omicron-omdb.tar.gz",
+  "cockroachdb-sql.tar.gz",
   "zone-setup.tar.gz",
   "zone-network-install.tar.gz",
   "opte-interface-setup.tar.gz",
@@ -300,6 +301,17 @@ source.paths = [
 output.type = "zone"
 output.intermediate_only = true
 
+[package.cockroachdb-sql]
+service_name = "cockroachdb-sql"
+only_for_targets.image = "standard"
+source.type = "local"
+source.paths = [
+  { from = "out/downloads/cockroach/cockroach-sql", to = "/opt/oxide/cockroachdb/bin/cockroach-sql" },
+]
+output.type = "zone"
+output.intermediate_only = true
+setup_hint = "Run `cargo xtask download cockroach` to download the necessary binaries"
+
 [package.internal-dns-cli]
 service_name = "internal-dns-cli"
 only_for_targets.image = "standard"
@@ -832,6 +844,7 @@ source.packages = [
   "switch_zone_setup.tar.gz",
   "xcvradm.tar.gz",
   "omicron-omdb.tar.gz",
+  "cockroachdb-sql.tar.gz",
   "zone-setup.tar.gz",
   "zone-network-install.tar.gz"
 ]
@@ -858,6 +871,7 @@ source.packages = [
   "switch_zone_setup.tar.gz",
   "sp-sim-stub.tar.gz",
   "omicron-omdb.tar.gz",
+  "cockroachdb-sql.tar.gz",
   "zone-setup.tar.gz",
   "zone-network-install.tar.gz"
 ]
@@ -884,6 +898,7 @@ source.packages = [
   "switch_zone_setup.tar.gz",
   "sp-sim-softnpu.tar.gz",
   "omicron-omdb.tar.gz",
+  "cockroachdb-sql.tar.gz",
   "zone-setup.tar.gz",
   "zone-network-install.tar.gz"
 ]
diff --git a/tools/cockroachdb_checksums b/tools/cockroachdb_checksums
index bd1759a90c0..5bef61239c0 100644
--- a/tools/cockroachdb_checksums
+++ b/tools/cockroachdb_checksums
@@ -1,4 +1,4 @@
-COCKROACH_COMMIT="2eee7afbdfd48760ce5d6c403573a5fd31de73cd"
-CIDL_SHA256_DARWIN="8cb9ca4b4584fadef18031f10c3f62e22f992afb5705561424dce4f42612728c"
-CIDL_SHA256_LINUX="1d79acf67d395ecf01419aa5f7eae620351073c409a14c527d22a59b2c658be9"
-CIDL_SHA256_ILLUMOS="50d7b052df645049195bd632afe2fa6ddbdfa6378a9b294e89f83a5ffa2b4af5"
+COCKROACH_COMMIT="367bca413bc24e6213a45663fccd583cc726ba08"
+CIDL_SHA256_DARWIN="6675eaa8c92fff47df13e71f9ef20f41dd2088fc019deab199343f4e0ef4f19b"
+CIDL_SHA256_LINUX="cbc7c02213d5c970f332aaa30e55d627acca629f8fd23c1ef2c8f62ff89b7f81"
+CIDL_SHA256_ILLUMOS="841f4d4fe439161ee8118a77c55b80c7df9415f1b9f71034ddfbb09f2a65b0df"
diff --git a/tools/cockroachdb_version b/tools/cockroachdb_version
index 6708cf85b36..9d06ce22276 100644
--- a/tools/cockroachdb_version
+++ b/tools/cockroachdb_version
@@ -1 +1 @@
-v22.1.22-44-g2eee7afbdf
+v22.1.22-46-g367bca413b