diff --git a/component/mariadb/buildout.cfg b/component/mariadb/buildout.cfg
index 7510e0002fe23ed074d4d1a274def9d5ba43684b..af95eae68406c25065c3a74b2d26274e474f7f1a 100644
--- a/component/mariadb/buildout.cfg
+++ b/component/mariadb/buildout.cfg
@@ -29,8 +29,8 @@ parts =
 [mariadb]
 recipe = slapos.recipe.cmmi
 url = https://downloads.mariadb.org/f/mariadb-${:version}/source/mariadb-${:version}.tar.gz/from/http%3A//fr.mirror.babylon.network/mariadb/?serve
-version = 10.3.22
-md5sum = f712a5e6fde038d0c9c6d2a2cd88b84e
+version = 10.4.12
+md5sum = 97d7c0f508c04a31c138fdb24e95dbc4
 location = ${buildout:parts-directory}/${:_buildout_section_name_}
 pre-configure =
   set -e '\bSET(PLUGIN_AUTH_PAM YES)' cmake/build_configurations/mysql_release.cmake
@@ -76,9 +76,10 @@ environment =
   CMAKE_INCLUDE_PATH=${bzip2:location}/include:${libaio:location}/include:${libaio:location}/include:${libxml2:location}/include:${ncurses:location}/include:${openssl:location}/include:${readline5:location}/include:${xz-utils:location}/include:${zlib:location}/include:${unixodbc:location}/include:${lz4:location}/include:${snappy:location}/include:${zstd:location}/include
   CMAKE_LIBRARY_PATH=${:CMAKE_LIBRARY_PATH}
   LDFLAGS=-L${bzip2:location}/lib -L${jemalloc:location}/lib -L${libaio:location}/lib -L${xz-utils:location}/lib -L${zlib:location}/lib -L${unixodbc:location}/lib -L${lz4:location}/lib -L${snappy:location}/lib -L${zstd:location}/lib
-post-install =
-  mkdir -p ${:location}/include/wsrep &&
-  cp -p wsrep/wsrep_api.h ${:location}/include/wsrep
+post-install = set -e
+  set -- wsrep-lib/wsrep-API/*/wsrep_api.h
+  install -DpT $1 ${:location}/$1
+  cp -a wsrep-lib/include ${:location}/wsrep-lib
 
 [mroonga-mariadb]
 # mroonga - a storage engine for MySQL. It provides fast fulltext search feature to all MySQL users.
@@ -89,15 +90,10 @@ md5sum = d0af673f1bad3b9ccf33870bb2344a25
 pre-configure = set -e
   rm -rf fake_mariadb_source
   mkdir -p fake_mariadb_source
-  test -d ${mariadb:location}/include/mysql/server/private && (
-    mkdir -p fake_mariadb_source/sql
-    cp -a ${mariadb:location}/include/mysql/server/private/* fake_mariadb_source/sql
-    cp -a ${mariadb:location}/include/mysql/server/*.h fake_mariadb_source/sql
-    cp -a ${mariadb:location}/include/mysql/server/mysql fake_mariadb_source/sql
-  ) || ln -s ${mariadb:location}/include/mysql/private fake_mariadb_source/sql
-  cp -ar ${mariadb:location}/include fake_mariadb_source/include
-  ! test -f fake_mariadb_source/include/mysql/mariadb_stmt.h ||
-  sed -i -E -e '/^enum enum_(cursor|indicator)_type$/,/};/d' fake_mariadb_source/include/mysql/mariadb_stmt.h
+  cd fake_mariadb_source
+  ln -s ${mariadb:location}/wsrep-lib
+  cp -a ${mariadb:location}/include/mysql/server include
+  mv include/private sql
 configure-options =
   --with-mysql-source=fake_mariadb_source
   --with-mysql-config=${mariadb:location}/bin/mysql_config
@@ -106,8 +102,6 @@ configure-options =
 patch-options = -p1
 patches =
   ${:_profile_base_location_}/mroonga_boolean.patch#c818568fe35ca6a4298f18e575d962a0
-pre-build =
-  sed -i -e "s,${mariadb:location}/include,$(pwd)/fake_mariadb_source/include,g" Makefile */Makefile
 environment =
   PATH=${binutils:location}/bin:${groonga:location}/bin:${patch:location}/bin:${pkgconfig:location}/bin:%(PATH)s
   CPPFLAGS=-I${groonga:location}/include/groonga
diff --git a/software/neoppod/software-common.cfg b/software/neoppod/software-common.cfg
index c0cfc40fc85e23e2219f3cd508bc31b74124cdcf..f31ca08bbf7447910700678a27c06ca5a99a777b 100644
--- a/software/neoppod/software-common.cfg
+++ b/software/neoppod/software-common.cfg
@@ -137,6 +137,7 @@ template =
     '${mariadb:location}/scripts/mysql_install_db' \
       --defaults-file='{{defaults_file}}' \
       --skip-name-resolve \
+      --auth-root-authentication-method=normal \
       --basedir='${mariadb:location}' \
       --datadir="$datadir.new"
     mv -v "$datadir.new" "$datadir"
diff --git a/stack/erp5/buildout.hash.cfg b/stack/erp5/buildout.hash.cfg
index de221715cc0616b5d1a3363223842e5a7be2690f..abf0b5ffac7b6241a764e360d511cc2ba9e2a6d1 100644
--- a/stack/erp5/buildout.hash.cfg
+++ b/stack/erp5/buildout.hash.cfg
@@ -14,7 +14,7 @@
 # not need these here).
 [mariadb-resiliency-after-import-script]
 filename = instance-mariadb-resiliency-after-import-script.sh.in
-md5sum = aff3bb574c8f0a2db9911fee30540e12
+md5sum = 85ce1e2f3d251aa435fef8118dca8a63
 
 [mariadb-slow-query-report-script]
 filename = mysql-querydigest.sh.in
@@ -22,11 +22,11 @@ md5sum = 0c0d98a68230cd0ad36046bb25b35f4a
 
 [mariadb-start-clone-from-backup]
 filename = instance-mariadb-start-clone-from-backup.sh.in
-md5sum = d95e8500bdc72d1f40b97cc414656e7e
+md5sum = d10b8e35b02b5391cf46bf0c7dbb1196
 
 [template-mariadb]
 filename = instance-mariadb.cfg.in
-md5sum = b29449652ef996c267518e4dcfd8e9e1
+md5sum = 0eb2f45a145dde0c59d3488bfdbe66ff
 
 [template-kumofs]
 filename = instance-kumofs.cfg.in
diff --git a/stack/erp5/instance-mariadb-resiliency-after-import-script.sh.in b/stack/erp5/instance-mariadb-resiliency-after-import-script.sh.in
index 9675cde034fe76763b14468a7a57733e451f4f2f..0a4671bf2ea99d0a6d6c3d71cc08f3c6e9d65da7 100644
--- a/stack/erp5/instance-mariadb-resiliency-after-import-script.sh.in
+++ b/stack/erp5/instance-mariadb-resiliency-after-import-script.sh.in
@@ -59,7 +59,7 @@ fi
 echo "Importing data..."
 # Use latest dump XXX can contain funny characters
 dump=$(ls -r "$mariadb_backup_directory" | head -1)
-zcat "$mariadb_backup_directory/$dump" | $mysql_executable -u root || {
+zcat "$mariadb_backup_directory/$dump" | $mysql_executable || {
   RESTORE_EXIT_CODE=$?
   echo 'Backup restoration failed.'
   exit $RESTORE_EXIT_CODE
diff --git a/stack/erp5/instance-mariadb-start-clone-from-backup.sh.in b/stack/erp5/instance-mariadb-start-clone-from-backup.sh.in
index 0bb7dbfde77760ebb7524984fd55ea38fc928fef..461da4700659bb1a0dcd9cd257efbe0a241fabf0 100644
--- a/stack/erp5/instance-mariadb-start-clone-from-backup.sh.in
+++ b/stack/erp5/instance-mariadb-start-clone-from-backup.sh.in
@@ -84,16 +84,16 @@ done
 "$UPDATE"
 
 echo "Importing $BACKUP ..."
-zcat "$BACKUP" | "$CLIENT" -u root
+zcat "$BACKUP" | "$CLIENT"
 
 echo "Configuring server as slave..."
 if [ "$MASTER_USE_GTID" -eq 1 ]; then
-  "$CLIENT" -u root -e "$SQL_SET_GTID"
+  "$CLIENT" -e "$SQL_SET_GTID"
   MASTER_USE_GTID_SQL="slave_pos"
 else
   MASTER_USE_GTID_SQL="NO"
 fi
-"$CLIENT" -u root -e "
+"$CLIENT" -e "
   CHANGE MASTER TO
   MASTER_HOST='$MASTER_HOST',
   MASTER_USER='$MASTER_USER',
@@ -111,9 +111,9 @@ if [ "$MASTER_USE_GTID" -eq 0 ]; then
   # Notes:
   # - Must happen after setting MASTER_HOST & MASTER_PORT.
   # - Implicitly sets MASTER_USE_GTID=NO if it was set before.
-  "$CLIENT" -u root -e "$SQL_CHANGE_MASTER"
+  "$CLIENT" -e "$SQL_CHANGE_MASTER"
 fi
-"$CLIENT" -u root -e "START SLAVE;"
+"$CLIENT" -e "START SLAVE;"
 
 echo "Stopping mariadb..."
 trap EXIT
diff --git a/stack/erp5/instance-mariadb.cfg.in b/stack/erp5/instance-mariadb.cfg.in
index 7dc04ca69789dc965193c2e627190bd2247b8948..d5b40615c747918b26081a8f1204a03f871bef99 100644
--- a/stack/erp5/instance-mariadb.cfg.in
+++ b/stack/erp5/instance-mariadb.cfg.in
@@ -107,7 +107,7 @@ time = {{ dumps(backup_periodicity) }}
 #   can be fully restored.
 # master-data: use value "2" as we are not in a replication case
 #}
-command = "${binary-wrap-mysqldump:wrapper-path}" -u root --all-databases --flush-privileges --single-transaction --max-allowed-packet=128M {% if incremental_backup_retention_days > -1 %}--flush-logs --master-data=2 {% endif %}| {{ parameter_dict['gzip-location'] }}/bin/gzip > "${directory:mariadb-backup-full}/$({{ parameter_dict['coreutils-location'] }}/bin/date "+%Y%m%d%H%M%S").sql.gz"
+command = "${binary-wrap-mysqldump:wrapper-path}" --all-databases --flush-privileges --single-transaction --max-allowed-packet=128M {% if incremental_backup_retention_days > -1 %}--flush-logs --master-data=2 {% endif %}| {{ parameter_dict['gzip-location'] }}/bin/gzip > "${directory:mariadb-backup-full}/$({{ parameter_dict['coreutils-location'] }}/bin/date "+%Y%m%d%H%M%S").sql.gz"
 {# KEEP GLOB PATTERN IN SYNC with generated filenames above
 #           YYYYmmddHHMMSS -#}
 file-glob = ??????????????.sql.gz
@@ -206,7 +206,7 @@ context = section parameter_dict odbc-ini-text
 < = logrotate-entry-base
 name = mariadb
 log = ${my-cnf-parameters:error-log} ${my-cnf-parameters:slow-query-log}
-post = "${binary-wrap-mysql:wrapper-path}" -B -u root -e "FLUSH LOGS"
+post = "${binary-wrap-mysql:wrapper-path}" -B -e "FLUSH LOGS"
 
 [{{ section('binary-link') }}]
 recipe = slapos.cookbook:symbolic.link