diff --git a/plugins/mariadb/flake.nix b/plugins/mariadb/flake.nix
index 1ac539e6357..c2c2f09a7ef 100644
--- a/plugins/mariadb/flake.nix
+++ b/plugins/mariadb/flake.nix
@@ -14,27 +14,30 @@
         nativeBuildInputs = [ nixpkgs.legacyPackages.{{.System}}.makeWrapper];
         postBuild = ''
 
-          wrapProgram $out/bin/mysqld \
-            --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
-
           wrapProgram $out/bin/mariadbd \
-            --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
-
-          wrapProgram $out/bin/mysqld_safe \
-            --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
+            --add-flags '--defaults-file=''$MYSQL_CONF --basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
 
           if [-f $out/bin/mariadbd-safe]; then
             wrapProgram $out/bin/mariadbd_safe \
-              --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
+              --add-flags '--defaults-file=''$MYSQL_CONF --basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
           fi
 
-          wrapProgram "$out/bin/mysql_install_db" \
-            --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --basedir=''$MYSQL_BASEDIR';
-
           if [-f $out/bin/mariadb-install-db]; then
             wrapProgram "$out/bin/mariadb_install_db" \
               --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --basedir=''$MYSQL_BASEDIR';
           fi
+
+          wrapProgram $out/bin/mariadb-admin \
+            --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT';
+
+          wrapProgram $out/bin/mariadb \
+            --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT';
+
+          wrapProgram $out/bin/mariadb-dump \
+            --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT';
+
+          # Don't wrap 'mysql' or any mysql binaries, as they are correctly left as symlinks
+
         '';
       };
     in{
diff --git a/plugins/mariadb/my.cnf b/plugins/mariadb/my.cnf
index fbe15dd80be..83716567cdf 100644
--- a/plugins/mariadb/my.cnf
+++ b/plugins/mariadb/my.cnf
@@ -1,6 +1,17 @@
-# MySQL configuration file
+# MySQL configuration file for Devbox MariaDB
+#
+# This file is read via --defaults-file, which means ONLY this config file
+# is read (system configs in /etc/ are skipped).
+#
+# Runtime paths (datadir, socket, pid-file, basedir) are set by the wrapper
+# script via environment variables and cannot be overridden here:
+#
+#   MYSQL_DATADIR  = --datadir   (default: .devbox/virtenv/mariadb/data)
+#   MYSQL_UNIX_PORT = --socket   (default: .devbox/virtenv/mariadb/run/mysql.sock)
+#   MYSQL_PID_FILE = --pid-file  (default: .devbox/virtenv/mariadb/run/mysql.pid)
 
 [mariadbd]
-# Change this port if 3306 is already used
-#port = 3306
-log_error=mysql.log
+
+# The TCP/IP port the server listens on.
+# Change this if 3306 is already in use.
+# port = 3306
diff --git a/plugins/mysql/flake.nix b/plugins/mysql/flake.nix
index 74787d4497e..333e77bcb7a 100644
--- a/plugins/mysql/flake.nix
+++ b/plugins/mysql/flake.nix
@@ -15,10 +15,19 @@
         postBuild = ''
 
           wrapProgram $out/bin/mysqld \
-            --add-flags '--basedir=''$MYSQL_BASEDIR --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
+            --add-flags '--defaults-file=''$MYSQL_CONF --basedir=''$MYSQL_BASEDIR --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
 
           wrapProgram $out/bin/mysqld_safe \
-            --add-flags '--basedir=''$MYSQL_BASEDIR --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
+            --add-flags '--defaults-file=''$MYSQL_CONF --basedir=''$MYSQL_BASEDIR --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
+
+          wrapProgram $out/bin/mysqladmin \
+            --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT';
+
+          wrapProgram $out/bin/mysql \
+            --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT';
+
+          wrapProgram $out/bin/mysqldump \
+            --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT';
         '';
       };
     in{
diff --git a/plugins/mysql/my.cnf b/plugins/mysql/my.cnf
index a749c470084..43bbd19478e 100644
--- a/plugins/mysql/my.cnf
+++ b/plugins/mysql/my.cnf
@@ -1,6 +1,19 @@
-# MySQL configuration file
+# MySQL configuration file for Devbox MySQL
+#
+# This file is read via --defaults-file, which means ONLY this config file
+# is read (system configs in /etc/ are skipped).
+#
+# Runtime paths (datadir, socket, pid-file, basedir) are set by the wrapper
+# script via environment variables and cannot be overridden here:
+#
+#   MYSQL_DATADIR  = --datadir   (default: .devbox/virtenv/mysql/data)
+#   MYSQL_UNIX_PORT = --socket   (default: .devbox/virtenv/mysql/run/mysql.sock)
+#   MYSQL_PID_FILE = --pid-file  (default: .devbox/virtenv/mysql/run/mysql.pid)
 
-# [mysqld]
+[mysqld]
+# Uncomment to disable binary logging.
 # skip-log-bin
-# Change this port if 3306 is already used
+#
+# The TCP/IP port the server listens on.
+# Change this if 3306 is already in use.
 #port = 3306