diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index fcb150407..fd14e21ba 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,8 +9,6 @@ updates:
     open-pull-requests-limit: 25
     directory: "/bom-weekly"
     ignore:
-      - dependency-name: "org.jenkins-ci.plugins:script-security"
-        versions: ["1310.vf24a_dfce068b_"]
       - dependency-name: "io.jenkins.plugins:custom-folder-icon"
         versions: ["2.11"]
     schedule:
diff --git a/README.md b/README.md
index 2d86413a7..f80c7db08 100644
--- a/README.md
+++ b/README.md
@@ -191,6 +191,15 @@ DOCKERIZED=true
 
 to reproduce image-specific failures.
 
+You can also pass
+
+```sh
+PCT_OPTS=--local-checkout-dir=/path/to/plugin
+```
+
+to check a local patch without waiting for incrementals deployment,
+if you have switched the version in `bom-weekly/pom.xml` to a `*-SNAPSHOT`.
+
 To minimize cloud resources, PCT is not run at all by default on pull requests, only some basic sanity checks.
 Add the label `full-test` to run PCT in a PR.
 If you lack triage permission and so cannot add this label, then you may instead
diff --git a/bom-weekly/pom.xml b/bom-weekly/pom.xml
index 4ecd623f4..4991144e5 100644
--- a/bom-weekly/pom.xml
+++ b/bom-weekly/pom.xml
@@ -879,7 +879,7 @@
       <dependency>
         <groupId>org.jenkins-ci.plugins</groupId>
         <artifactId>script-security</artifactId>
-        <version>1305.v487433146192</version>
+        <version>1313.v7a_6067dc7087</version>
       </dependency>
       <dependency>
         <groupId>org.jenkins-ci.plugins</groupId>
diff --git a/pct.sh b/pct.sh
index 83b6f1f35..83c33f91b 100755
--- a/pct.sh
+++ b/pct.sh
@@ -27,6 +27,7 @@ exec java \
 	--include-plugins "${PLUGINS}" \
 	--working-dir "$(pwd)/target/pct-work" \
 	$PCT_D_ARGS \
+	${PCT_OPTS-} \
 	-Djth.jenkins-war.path="$(pwd)/target/megawar-$LINE.war" \
 	-Dsurefire.excludesFile="$(pwd)/excludes.txt"