diff --git a/utils/docker/Dockerfile b/utils/docker/Dockerfile
index 2d3c33e3..c11f181e 100644
--- a/utils/docker/Dockerfile
+++ b/utils/docker/Dockerfile
@@ -49,3 +49,11 @@ RUN if dpkg --compare-versions "$(dpkg-query -W -f '${Version}' libsqlite3-0)" l
 	fi
 
 COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
+
+# Debian releases before 12 keep commands such as `more` in /bin only, where the GitHub runners
+# have them in /usr/bin as well, and scenarios refer to them there.
+RUN for command in more; do \
+		[ -e "/usr/bin/${command}" ] || [ ! -e "/bin/${command}" ] || ln -s "/bin/${command}" "/usr/bin/${command}"; \
+	done
+
+COPY mariadb /usr/local/bin/mariadb
diff --git a/utils/docker/mariadb b/utils/docker/mariadb
new file mode 100755
index 00000000..fdf33ea1
--- /dev/null
+++ b/utils/docker/mariadb
@@ -0,0 +1,17 @@
+#!/bin/sh
+# MariaDB 11.4 and later warn on STDERR that they cannot verify the certificate of a MySQL server
+# when the password does not come from the command line, as with MYSQL_PWD that WP-CLI uses. The
+# MySQL client on the GitHub runners does not, so scenarios expecting an empty STDERR would only
+# fail in the containers. The server is a throwaway in the worker's own network namespace.
+
+# Options about option files have to come first.
+defaults=
+while :; do
+	case "$1" in
+		--no-defaults|--print-defaults|--defaults-file=*|--defaults-extra-file=*|--defaults-group-suffix=*) defaults="$defaults $1"; shift ;;
+		*) break ;;
+	esac
+done
+
+# shellcheck disable=SC2086
+exec /usr/bin/mariadb $defaults --skip-ssl-verify-server-cert "$@"