diff --git a/support/chip-testing/test/core/IDM.test.ts b/support/chip-testing/test/core/IDM.test.ts
index 19720ca3fd..edb2aaeb2f 100644
--- a/support/chip-testing/test/core/IDM.test.ts
+++ b/support/chip-testing/test/core/IDM.test.ts
@@ -6,16 +6,16 @@
 
 describe("IDM", () => {
     chip("IDM/*").exclude(
-        // Spec issues for DoorLock, see https://github.com/CHIP-Specifications/connectedhomeip-spec/issues/11712
-        //  Summary: the command responses from command 0xa and 0x15 have "wider" conformance than the requests which
-        //           leads to the effect that the responses are expected to be present but are not because we do not
-        //           have the requests. After Spec fix of conformance, the chip model used in test will match again
-        "IDM/10.2",
-
         // IDM 10.4 in TC_pics_checker.py appears to fail because it needs an endpoint ID specified
         // TODO - we could look at wiring this but would need to select the endpoints to check and manually create runs
         // ...and if I was going to do anything automatically with PICS I would probably generate from device
         "IDM/10.4",
     );
-    chip("IDM/*/run1");
+    chip("IDM/*/run1").exclude(
+        // Spec issues for DoorLock, see https://github.com/CHIP-Specifications/connectedhomeip-spec/issues/11712
+        //  Summary: the command responses from command 0xa and 0x15 have "wider" conformance than the requests which
+        //           leads to the effect that the responses are expected to be present but are not because we do not
+        //           have the requests. After Spec fix of conformance, the chip model used in test will match again
+        "IDM/10.2/*",
+    );
 });
diff --git a/support/chip-testing/test/core/SC.test.ts b/support/chip-testing/test/core/SC.test.ts
index 27790c81a0..00f458371e 100644
--- a/support/chip-testing/test/core/SC.test.ts
+++ b/support/chip-testing/test/core/SC.test.ts
@@ -19,24 +19,6 @@ describe("SC", () => {
     before(async () => {
         await chip.clearMdns();
 
-        const sc41 = chip.testFor("SC/4.1");
-        await sc41.edit(
-            edit.sed(
-                // We can pass values to YAML tests using e.g. .args("--", "deviceType", 257)...  But AFAICT there is no
-                // support for converting this value to an integer, even though the config schema specifies "int16u"
-                // explicitly.  So, the test then fails because 257 !== "257".  Instead we just rewrite the test
-                // definition
-                "s/defaultValue: 65535/defaultValue: 257/",
-
-                // We do not like ridiculously long waits; reduce commissioning timeout.  Unfortunately test framework
-                // is slow so we can't reduce to a reasonable level but 10s is still way better than 3m.
-                "s/value: 180/value: 10/",
-
-                // Also reduce the test delay that waits for timeout
-                "s/value: 180000/value: 10000/",
-            ),
-        );
-
         const sc71 = chip.testFor("SC/7.1");
         await sc71.edit(
             edit.sed(
@@ -53,14 +35,17 @@ describe("SC", () => {
 
     chip("SC/*").exclude(
         // These require additional configuration below
-        "SC/4.1",
+        "SC/4.1/*",
         "SC/7.1",
     );
 
-    // SC/4.1 needs MDNS cleared
-    chip("SC/4.1").beforeStart(async () => {
-        await chip.clearMdns();
-    });
+    // SC/4.1 needs MDNS cleared.  run1 has the wrong manual code; run2 has a pairing code that works.  Not sure what's
+    // up with that.  run3 is LIT ICD so not relevant for us
+    [chip("SC/4.1/run1").args("--manual-code", "34970112332"), chip("SC/4.1/run2")].forEach(builder =>
+        builder.beforeStart(async () => {
+            await chip.clearMdns();
+        }),
+    );
 
     // 7.1 must start factory fresh
     chip("SC/7.1").uncommissioned();
diff --git a/support/chip/bin/build b/support/chip/bin/build
index 659a575400..68971f20b1 100755
--- a/support/chip/bin/build
+++ b/support/chip/bin/build
@@ -36,9 +36,9 @@ fi
 
 export VERSION="$ACTOR-$(date -u +%Y%m%dT%H%M%S)-$(git rev-parse HEAD | cut -c 1-12)"
 
-
+# We only write to /tmp/chip.tar but the entitlement path to that specific file no longer works
 docker buildx bake \
     --file "$CHIP_DIR/docker-bake.hcl" \
     --builder matter.js-chip \
-    --allow=fs.write=/tmp/chip.tar \
+    --allow=fs.write=/tmp \
     $*
diff --git a/support/chip/sha.txt b/support/chip/sha.txt
index 42712b8bb4..4c26577da4 100644
--- a/support/chip/sha.txt
+++ b/support/chip/sha.txt
@@ -1 +1 @@
-b6d5f940d65ac6dc559cff92b44f798781b1ca0b
+ba864e99fe4d8c624531dff2780071424307cfe7
diff --git a/support/chip/support/generate-test-descriptor b/support/chip/support/generate-test-descriptor
index 6f25f7ea99..3e4d5cac0f 100755
--- a/support/chip/support/generate-test-descriptor
+++ b/support/chip/support/generate-test-descriptor
@@ -179,6 +179,8 @@ def load_python():
         try:
             importlib.import_module(name)
         except ModuleNotFoundError as e:
+            sys.stderr.write(f"Error in {path}: {e}\n")
+
             # Skip files with whitelisted errors.  Do not skip all errors or build problems may go unnoticed
             if "No module named 'matter.webrtc'" in str(e):
                 # We neither test nor install webrtc support.  Test does not fail gracefully
@@ -186,6 +188,9 @@ def load_python():
             elif "No module named 'chip." in str(e):
                 # SHA e8a92c8f1037d134d8f477cdc238d2f3a8a42f8b brings in file that references obsolete package names
                 pass
+            elif "No module named 'ndef'" in str(e):
+                # NFC support
+                pass
             else:
                 raise