diff --git a/docker/mariadb/Dockerfile.j2 b/docker/mariadb/Dockerfile.j2
index 9e22986687..111a884cd1 100644
--- a/docker/mariadb/Dockerfile.j2
+++ b/docker/mariadb/Dockerfile.j2
@@ -50,6 +50,17 @@ RUN chmod 755 /usr/local/bin/kolla_extend_start \
 {% if base_distro in ['debian', 'ubuntu'] %}
 RUN mkdir -p /var/run/mysqld && chown mysql /var/run/mysqld && chmod 755 /var/run/mysqld
 {% endif %}
+
+{% block mariadb_entrypoint %}
+# NOTE(mgoddard): Override the dumb-init arguments to avoid passing
+# --single-child. This does not play well with mysqld_safe, which ignores
+# SIGTERM, meaning Docker needs to forcibly kill the container to stop it.
+# Without --single-child, the TERM signal is sent to all subprocesses,
+# including mysqld.
+ENTRYPOINT ["dumb-init"]
+CMD ["kolla_start"]
+{% endblock %}
+
 {% block mariadb_footer %}{% endblock %}
 {% block footer %}{% endblock %}
 
diff --git a/docker/mariadb/extend_start.sh b/docker/mariadb/extend_start.sh
index 310f79c2cc..88be89d025 100644
--- a/docker/mariadb/extend_start.sh
+++ b/docker/mariadb/extend_start.sh
@@ -38,6 +38,19 @@ if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
     exit 0
 fi
 
+# This catches all cases of the KOLLA_UPGRADE variable being set, including empty
+if [[ "${!KOLLA_UPGRADE[@]}" ]]; then
+    # The mysql_upgrade command treats any directories under /var/lib/mysql as
+    # databases. Somehow we can end up with a .pki directory, which causes the
+    # command to fail with this error:
+    # Incorrect database name '#mysql50#.pki' when selecting the database
+    # There doesn't seem to be anything in the directory, so remove it.
+    rm -rf /var/lib/mysql/.pki
+
+    mysql_upgrade --user=root --password="${DB_ROOT_PASSWORD}"
+    exit 0
+fi
+
 if [[ "${!BOOTSTRAP_ARGS[@]}" ]]; then
     ARGS="${BOOTSTRAP_ARGS}"
 fi