diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 708755b25..7196645ac 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -99,8 +99,11 @@ jobs:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
   # MariaDB functional leg (one cell): keeps the MySQL-only branches —
   # ke_search MATCH...AGAINST retrieval — permanently exercised in CI.
-  # mariadb:10.11 LTS: images >= 11 ship only mariadb-admin, which fails
-  # the reusable workflow's hardcoded mysqladmin health check.
+  # mariadb:11.8 — one of the two current LTS series (11.8, 12.3); the e2e
+  # leg runs the other, so CI covers both. This sat on 10.11 because images
+  # >= 11 ship only mariadb-admin while the reusable workflow health-checked
+  # with a hardcoded mysqladmin, so the service never turned healthy
+  # (netresearch/typo3-ci-workflows#128, fixed there in #174).
   # The full matrix above stays on SQLite; this narrow second call exists ONLY
   # for the MariaDB functional leg.
   ci-functional-mariadb:
@@ -112,7 +115,7 @@ jobs:
       typo3-versions: '["^14.3"]'
       run-functional-tests: true
       functional-test-db: mariadb
-      db-image: 'mariadb:10.11'
+      db-image: 'mariadb:11.8'
       # Shard by test class here too. With the SQLite cells down to ~2.5min this
       # leg became the single longest job in CI at 6min, i.e. the whole
       # critical-path term of the wall clock.
@@ -122,7 +125,7 @@ jobs:
       # identifier — $originalDatabaseName . '_ft' . substr(sha1(static::class), 0, 7)
       # (FunctionalTestCase.php:361) — so each process creates its OWN database
       # (typo3_test_ft<hash>). No CREATE race, no shared state, and 4 processes
-      # are nowhere near mariadb:10.11's default max_connections of 151.
+      # are nowhere near mariadb:11.8's default max_connections of 151.
       #
       # No event split: this leg never uploaded coverage (upload-coverage is
       # unset here, so the reusable resolves coverage: none). It exists purely to
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index c5c6a4bc3..71a78763d 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -28,7 +28,9 @@ jobs:
       contents: read
     with:
       php-version: '8.5'
-      db-image: 'mariadb:12.2'
+      # 12.3, not 12.2: 12.0-12.2 are rolling releases, 12.3 is the LTS of
+      # the 12 series (and the only 12.x still built — 12.2 stopped in May).
+      db-image: 'mariadb:12.3'
       # Seed WAITING_FOR_APPROVAL/INPUT runs before Playwright so the a11y
       # suite can exercise the approve/deny + schema-input forms (ADR-109).
       # Default-mode override: the workflow sets up TYPO3 and starts the
diff --git a/Build/Scripts/runTests.sh b/Build/Scripts/runTests.sh
index 2d09f8b03..75dc3c54c 100755
--- a/Build/Scripts/runTests.sh
+++ b/Build/Scripts/runTests.sh
@@ -82,10 +82,38 @@ handle_dbms_options() {
                 echo "Invalid combination -d ${DBMS} -a ${DATABASE_DRIVER}" >&2
                 exit 1
             fi
-            [[ -z "${DBMS_VERSION}" ]] && DBMS_VERSION="11.4"
-            if ! [[ ${DBMS_VERSION} =~ ^(10.5|10.6|10.11|11.0|11.4)$ ]]; then
-                echo "Invalid combination -d ${DBMS} -i ${DBMS_VERSION}" >&2
-                exit 1
+            [[ -z "${DBMS_VERSION}" ]] && DBMS_VERSION="11.8"
+            # The MariaDB series still in community support (mariadb.org
+            # maintenance policy): 10.11 until 2028-02, 11.4 until 2029-05,
+            # 11.8 until 2028-06, 12.3 until 2029-06. 10.5, 10.6 and 11.0 are
+            # EOL; 12.0-12.2 are rolling releases, not LTS.
+            #
+            # A version that has left support is mapped onto the LTS of its own
+            # series rather than refused: `-i 10.5` sits in Makefiles, READMEs
+            # and muscle memory, and failing those calls buys nothing. The
+            # substitution is announced on every run, because a suite that
+            # silently ran a different engine than it was asked for is worse
+            # than a broken call. DBMS_VERSION_EXACT=1 skips mapping and check
+            # both, for reproducing a bug on the engine a customer operates.
+            if [[ "${DBMS_VERSION_EXACT:-0}" != "1" ]]; then
+                case "${DBMS_VERSION}" in
+                    10.5|10.6)           DBMS_VERSION_LTS="10.11" ;;
+                    11.0|11.1|11.2|11.3) DBMS_VERSION_LTS="11.4" ;;
+                    11.5|11.6|11.7)      DBMS_VERSION_LTS="11.8" ;;
+                    12.0|12.1|12.2)      DBMS_VERSION_LTS="12.3" ;;
+                    *)                   DBMS_VERSION_LTS="" ;;
+                esac
+                if [[ -n "${DBMS_VERSION_LTS}" ]]; then
+                    echo "WARNING: MariaDB ${DBMS_VERSION} is out of support (EOL, or a rolling release)." >&2
+                    echo "         Running ${DBMS_VERSION_LTS} instead — the supported series it belongs to." >&2
+                    echo "         Set DBMS_VERSION_EXACT=1 to run ${DBMS_VERSION} anyway." >&2
+                    DBMS_VERSION="${DBMS_VERSION_LTS}"
+                fi
+                if ! [[ ${DBMS_VERSION} =~ ^(10.11|11.4|11.8|12.3)$ ]]; then
+                    echo "Invalid combination -d ${DBMS} -i ${DBMS_VERSION}" >&2
+                    echo "Supported: 10.11, 11.4, 11.8, 12.3. Set DBMS_VERSION_EXACT=1 to run an unsupported version." >&2
+                    exit 1
+                fi
             fi
             ;;
         mysql)
@@ -157,7 +185,7 @@ Options:
         Database for functional tests (default: sqlite)
 
     -i version
-        Database version (mariadb: 11.4, mysql: 8.4, postgres: 16)
+        Database version (mariadb: 11.8, mysql: 8.4, postgres: 16)
 
     -p <8.2|8.3|8.4|8.5>
         PHP version (default: 8.5)