diff --git a/.github/workflows/external_trigger.yml b/.github/workflows/external_trigger.yml
index 811fce9..893af5c 100644
--- a/.github/workflows/external_trigger.yml
+++ b/.github/workflows/external_trigger.yml
@@ -29,7 +29,7 @@ jobs:
           echo "> [!NOTE]" >> $GITHUB_STEP_SUMMARY
           echo "> External trigger running off of master branch. To disable this trigger, add \`mariadb_master\` into the Github organizational variable \`SKIP_EXTERNAL_TRIGGER\`." >> $GITHUB_STEP_SUMMARY
           printf "\n## Retrieving external version\n\n" >> $GITHUB_STEP_SUMMARY
-          EXT_RELEASE=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.22/main/x86_64/APKINDEX.tar.gz" | tar -xz -C /tmp \
+          EXT_RELEASE=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.23/main/x86_64/APKINDEX.tar.gz" | tar -xz -C /tmp \
             && awk '/^P:'"mariadb"'$/,/V:/' /tmp/APKINDEX | sed -n 2p | sed 's/^V://')
           echo "Type is \`alpine_repo\`" >> $GITHUB_STEP_SUMMARY
           if grep -q "^mariadb_master_${EXT_RELEASE}" <<< "${SKIP_EXTERNAL_TRIGGER}"; then
@@ -107,7 +107,7 @@ jobs:
           if [ "${EXT_RELEASE_SANITIZED}" == "${IMAGE_VERSION}" ]; then
             echo "Sanitized version \`${EXT_RELEASE_SANITIZED}\` already pushed, exiting" >> $GITHUB_STEP_SUMMARY
             exit 0
-          elif [[ $(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.22/main/aarch64/APKINDEX.tar.gz" | tar -xz -C /tmp && awk '/^P:'"mariadb"'$/,/V:/' /tmp/APKINDEX | sed -n 2p | sed 's/^V://') != "${EXT_RELEASE}" ]]; then
+          elif [[ $(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.23/main/aarch64/APKINDEX.tar.gz" | tar -xz -C /tmp && awk '/^P:'"mariadb"'$/,/V:/' /tmp/APKINDEX | sed -n 2p | sed 's/^V://') != "${EXT_RELEASE}" ]]; then
             echo "New version \`${EXT_RELEASE}\` found; but not all arch repos updated yet; exiting" >> $GITHUB_STEP_SUMMARY
             FAILURE_REASON="New version ${EXT_RELEASE} for mariadb tag latest is detected, however not all arch repos are updated yet. Will try again later."
             curl -X POST -H "Content-Type: application/json" --data '{"avatar_url": "https://cdn.discordapp.com/avatars/354986384542662657/df91181b3f1cf0ef1592fbe18e0962d7.png","embeds": [{"color": 9802903,
diff --git a/Dockerfile b/Dockerfile
index 6d85b8d..fd3c6d0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM ghcr.io/linuxserver/baseimage-alpine:3.22
+FROM ghcr.io/linuxserver/baseimage-alpine:3.23
 
 # set version label
 ARG BUILD_DATE
@@ -16,7 +16,7 @@ ENV DATADIR="$MYSQL_DIR/databases"
 RUN \
   echo "**** install runtime packages ****" && \
   if [ -z ${MARIADB_VERSION+x} ]; then \
-    MARIADB_VERSION=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.22/main/x86_64/APKINDEX.tar.gz" | tar -xz -C /tmp \
+    MARIADB_VERSION=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.23/main/x86_64/APKINDEX.tar.gz" | tar -xz -C /tmp \
     && awk '/^P:mariadb$/,/V:/' /tmp/APKINDEX | sed -n 2p | sed 's/^V://'); \
   fi && \
   apk add --no-cache \
diff --git a/Dockerfile.aarch64 b/Dockerfile.aarch64
index 1ab4a20..dcffce7 100644
--- a/Dockerfile.aarch64
+++ b/Dockerfile.aarch64
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM ghcr.io/linuxserver/baseimage-alpine:arm64v8-3.22
+FROM ghcr.io/linuxserver/baseimage-alpine:arm64v8-3.23
 
 # set version label
 ARG BUILD_DATE
@@ -16,7 +16,7 @@ ENV DATADIR="$MYSQL_DIR/databases"
 RUN \
   echo "**** install runtime packages ****" && \
   if [ -z ${MARIADB_VERSION+x} ]; then \
-    MARIADB_VERSION=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.22/main/x86_64/APKINDEX.tar.gz" | tar -xz -C /tmp \
+    MARIADB_VERSION=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/v3.23/main/x86_64/APKINDEX.tar.gz" | tar -xz -C /tmp \
     && awk '/^P:mariadb$/,/V:/' /tmp/APKINDEX | sed -n 2p | sed 's/^V://'); \
   fi && \
   apk add --no-cache \
diff --git a/Jenkinsfile b/Jenkinsfile
index 4e9ce08..dcc6876 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -27,7 +27,7 @@ pipeline {
     DEV_DOCKERHUB_IMAGE = 'lsiodev/mariadb'
     PR_DOCKERHUB_IMAGE = 'lspipepr/mariadb'
     DIST_IMAGE = 'alpine'
-    DIST_REPO = 'http://dl-cdn.alpinelinux.org/alpine/v3.22/main/'
+    DIST_REPO = 'http://dl-cdn.alpinelinux.org/alpine/v3.23/main/'
     DIST_REPO_PACKAGES = 'mariadb'
     MULTIARCH='true'
     CI='true'
@@ -286,7 +286,7 @@ pipeline {
                   -v ${WORKSPACE}:/mnt \
                   -e AWS_ACCESS_KEY_ID=\"${S3_KEY}\" \
                   -e AWS_SECRET_ACCESS_KEY=\"${S3_SECRET}\" \
-                  ghcr.io/linuxserver/baseimage-alpine:3 s6-envdir -fn -- /var/run/s6/container_environment /bin/bash -c "\
+                  ghcr.io/linuxserver/baseimage-alpine:3.23 s6-envdir -fn -- /var/run/s6/container_environment /bin/bash -c "\
                     apk add --no-cache python3 && \
                     python3 -m venv /lsiopy && \
                     pip install --no-cache-dir -U pip && \
diff --git a/README.md b/README.md
index 79766a4..4cc1339 100644
--- a/README.md
+++ b/README.md
@@ -135,7 +135,7 @@ This image can be run with a non-root user. For details please [read the docs](h
 To help you get started creating a container from this image you can either use docker-compose or the docker cli.
 
 >[!NOTE]
->Unless a parameter is flaged as 'optional', it is *mandatory* and a value must be provided.
+>Unless a parameter is flagged as 'optional', it is *mandatory* and a value must be provided.
 
 ### docker-compose (recommended, [click here for more info](https://docs.linuxserver.io/general/docker-compose))
 
@@ -154,6 +154,7 @@ services:
       - MYSQL_USER=MYSQL_USER #optional
       - MYSQL_PASSWORD=DATABASE_PASSWORD #optional
       - REMOTE_SQL=http://URL1/your.sql,https://URL2/your.sql #optional
+      - CLI_OPTS= #optional
     volumes:
       - /path/to/mariadb/config:/config
     ports:
@@ -174,6 +175,7 @@ docker run -d \
   -e MYSQL_USER=MYSQL_USER `#optional` \
   -e MYSQL_PASSWORD=DATABASE_PASSWORD `#optional` \
   -e REMOTE_SQL=http://URL1/your.sql,https://URL2/your.sql `#optional` \
+  -e CLI_OPTS= `#optional` \
   -p 3306:3306 \
   -v /path/to/mariadb/config:/config \
   --restart unless-stopped \
@@ -195,6 +197,7 @@ Containers are configured using parameters passed at runtime (such as those abov
 | `-e MYSQL_USER=MYSQL_USER` | This user will have superuser access to the database specified by MYSQL_DATABASE (do not use root here). (valid only for first run) |
 | `-e MYSQL_PASSWORD=DATABASE_PASSWORD` | Set this to the password you want to use for you MYSQL_USER (minimum 4 characters & non-alphanumeric passwords must be properly escaped). (valid only for first run) |
 | `-e REMOTE_SQL=http://URL1/your.sql,https://URL2/your.sql` | Set this to ingest sql files from an http/https endpoint (comma seperated array). |
+| `-e CLI_OPTS=` | Pass CLI options to mariadbd via mariadbd-safe. Use with caution as mariadbd option precedence is complex. |
 | `-v /config` | Persistent config files |
 | `--read-only=true` | Run container with a read-only filesystem. Please [read the docs](https://docs.linuxserver.io/misc/read-only/). |
 | `--user=1000:1000` | Run container with a non-root user. Please [read the docs](https://docs.linuxserver.io/misc/non-root/). |
@@ -361,6 +364,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
 
 ## Versions
 
+* **14.02.25:** - Rebase to Alpine 3.23. Add ability to pass CLI options to mariadbd.
 * **09.07.25:** - Rebase to Alpine 3.22.
 * **11.01.25:** - Add log rotation, follow the instructions in the container log.
 * **06.01.25:** - Rebase to Alpine 3.21.
diff --git a/jenkins-vars.yml b/jenkins-vars.yml
index a4c3d52..462f437 100644
--- a/jenkins-vars.yml
+++ b/jenkins-vars.yml
@@ -15,7 +15,7 @@ repo_vars:
   - DEV_DOCKERHUB_IMAGE = 'lsiodev/mariadb'
   - PR_DOCKERHUB_IMAGE = 'lspipepr/mariadb'
   - DIST_IMAGE = 'alpine'
-  - DIST_REPO = 'http://dl-cdn.alpinelinux.org/alpine/v3.22/main/'
+  - DIST_REPO = 'http://dl-cdn.alpinelinux.org/alpine/v3.23/main/'
   - DIST_REPO_PACKAGES = 'mariadb'
   - MULTIARCH='true'
   - CI='true'
diff --git a/readme-vars.yml b/readme-vars.yml
index 6d893a5..220b9c0 100644
--- a/readme-vars.yml
+++ b/readme-vars.yml
@@ -30,6 +30,7 @@ opt_param_env_vars:
   - {env_var: "MYSQL_USER", env_value: "MYSQL_USER", desc: "This user will have superuser access to the database specified by MYSQL_DATABASE (do not use root here). (valid only for first run)"}
   - {env_var: "MYSQL_PASSWORD", env_value: "DATABASE_PASSWORD", desc: "Set this to the password you want to use for you MYSQL_USER (minimum 4 characters & non-alphanumeric passwords must be properly escaped). (valid only for first run)"}
   - {env_var: "REMOTE_SQL", env_value: "http://URL1/your.sql,https://URL2/your.sql", desc: "Set this to ingest sql files from an http/https endpoint (comma seperated array)."}
+  - {env_var: "CLI_OPTS", env_value: "", desc: "Pass CLI options to mariadbd via mariadbd-safe. Use with caution as mariadbd option precedence is complex."}
 readonly_supported: true
 readonly_message: |
   * `/tmp` must be mounted to tmpfs
@@ -143,6 +144,7 @@ init_diagram: |
   "mariadb:latest" <- Base Images
 # changelog
 changelogs:
+  - {date: "14.02.25:", desc: "Rebase to Alpine 3.23. Add ability to pass CLI options to mariadbd."}
   - {date: "09.07.25:", desc: "Rebase to Alpine 3.22."}
   - {date: "11.01.25:", desc: "Add log rotation, follow the instructions in the container log."}
   - {date: "06.01.25:", desc: "Rebase to Alpine 3.21."}
diff --git a/root/defaults/custom.cnf b/root/defaults/custom.cnf
index bb288cd..167795b 100644
--- a/root/defaults/custom.cnf
+++ b/root/defaults/custom.cnf
@@ -129,6 +129,8 @@ log_bin_index           = /config/log/mysql/mariadb-bin.index
 expire_logs_days        = 10
 max_binlog_size         = 100M
 # slaves
+# If not set in a single server environment binary logs will never be discarded - https://jira.mariadb.org/browse/MDEV-34504
+slave_connections_needed_for_purge = 0
 #relay_log              = /config/log/mysql/relay-bin
 #relay_log_index        = /config/log/mysql/relay-bin.index
 #relay_log_info_file    = /config/log/mysql/relay-bin.info
diff --git a/root/etc/s6-overlay/s6-rc.d/svc-mariadb/finish b/root/etc/s6-overlay/s6-rc.d/svc-mariadb/finish
deleted file mode 100755
index 0a13f7c..0000000
--- a/root/etc/s6-overlay/s6-rc.d/svc-mariadb/finish
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/usr/bin/with-contenv bash
-# shellcheck shell=bash
-
-echo "Caught SIGTERM signal!"
-
-kill -TERM "$(cat /run/mysqld/mysqld.pid)" 2>/dev/null
diff --git a/root/etc/s6-overlay/s6-rc.d/svc-mariadb/run b/root/etc/s6-overlay/s6-rc.d/svc-mariadb/run
index 37e6c58..09af08a 100755
--- a/root/etc/s6-overlay/s6-rc.d/svc-mariadb/run
+++ b/root/etc/s6-overlay/s6-rc.d/svc-mariadb/run
@@ -9,16 +9,12 @@ if [[ -z ${LSIO_NON_ROOT_USER} ]]; then
         --datadir="${DATADIR}" \
         --pid-file=/run/mysqld/mysqld.pid \
         --skip-networking=OFF \
-        --user=abc &
-
-    wait
+        --user=abc ${CLI_OPTS}
 else
     s6-notifyoncheck -d -n 300 -w 1000 -c "nc -z localhost 3306" \
         /usr/bin/mariadbd-safe \
         --defaults-extra-file=/config/custom.cnf \
         --datadir="${DATADIR}" \
         --pid-file=/run/mysqld/mysqld.pid \
-        --skip-networking=OFF &
-
-    wait
+        --skip-networking=OFF ${CLI_OPTS}
 fi