diff --git a/features/db-query.feature b/features/db-query.feature
index 07b5a262..cc0306cb 100644
--- a/features/db-query.feature
+++ b/features/db-query.feature
@@ -119,3 +119,21 @@ Feature: Query the database with WordPress' MySQL config
       """
       ANSI
       """
+
+  # Regression test for https://github.com/wp-cli/db-command/issues/309
+  # MariaDB 11.4+ verifies the server certificate by default and prints a warning to
+  # STDERR (or fails) against the auto-generated self-signed certificate, which broke
+  # the tests. `run()` now opts out via `--skip-ssl-verify-server-cert` on MariaDB, and
+  # both `ssl-verify-server-cert` and its `skip-` variant are allowed so the behaviour
+  # can be overridden. Assert the flag is forwarded to the MySQL client (visible in the
+  # debug output before the connection is attempted). SQLite does not use the MySQL
+  # client, hence the tag.
+  @require-mysql-or-mariadb
+  Scenario: Query forwards the ssl-verify-server-cert flags to the MySQL client
+    Given a WP install
+
+    When I try `wp db query "SELECT 1" --skip-ssl-verify-server-cert --debug`
+    Then STDERR should contain:
+      """
+      skip-ssl-verify-server-cert
+      """
diff --git a/src/DB_Command.php b/src/DB_Command.php
index dfa24586..db5a8442 100644
--- a/src/DB_Command.php
+++ b/src/DB_Command.php
@@ -1988,6 +1988,17 @@ private static function run( $cmd, $assoc_args = [], $send_to_shell = true, $int
 			unset( $assoc_args['dbpass'], $assoc_args['password'] );
 		}
 
+		// MariaDB 11.4 enables TLS server certificate verification by default. WP-CLI
+		// connects the same way WordPress does, which does not verify the certificate,
+		// and against MariaDB's auto-generated self-signed certificate verification
+		// either just warns on STDERR that it disabled itself or fails outright. Opt out
+		// explicitly to keep the previous behaviour, unless the user asked to verify.
+		if ( 'mariadb' === Utils\get_db_type()
+			&& ! isset( $assoc_args['ssl-verify-server-cert'] )
+			&& ! isset( $assoc_args['skip-ssl-verify-server-cert'] ) ) {
+			$required['skip-ssl-verify-server-cert'] = true;
+		}
+
 		$final_args = array_merge( $required, $assoc_args );
 
 		// Filter out empty string values to avoid passing empty parameters to MySQL commands
@@ -2232,6 +2243,7 @@ private static function get_mysql_args( $assoc_args ) {
 			'skip-pager',
 			'skip-reconnect',
 			'skip-ssl',
+			'skip-ssl-verify-server-cert',
 			'socket',
 			'ssl',
 			'ssl-ca',
@@ -2243,6 +2255,7 @@ private static function get_mysql_args( $assoc_args ) {
 			'ssl-fips-mode',
 			'ssl-key',
 			'ssl-mode',
+			'ssl-verify-server-cert',
 			'syslog',
 			'table',
 			'tee',