diff --git a/labs/osbash/lib/functions.guest.sh b/labs/osbash/lib/functions.guest.sh
index e42f9c25..c81c225f 100644
--- a/labs/osbash/lib/functions.guest.sh
+++ b/labs/osbash/lib/functions.guest.sh
@@ -2,6 +2,7 @@
 
 # Sourcing this file calls functions fix_path_env and source_deploy.
 
+source "$CONFIG_DIR/credentials"
 source "$LIB_DIR/functions.sh"
 source "$LIB_DIR/functions-common-devstack"
 
@@ -300,8 +301,7 @@ $option = $value
 function mysql_exe {
     local cmd="$1"
     echo "mysql cmd: $cmd."
-    # XXX install-guide uses password, but distro install uses socket auth
-    sudo mysql -u "root" -e "$cmd"
+    sudo mysql -u "root" -p"$DATABASE_PASSWORD" -e "$cmd"
 }
 
 function setup_database {
diff --git a/labs/osbash/scripts/ubuntu/apt_init.sh b/labs/osbash/scripts/ubuntu/apt_init.sh
index e2eca271..07e5c0a5 100755
--- a/labs/osbash/scripts/ubuntu/apt_init.sh
+++ b/labs/osbash/scripts/ubuntu/apt_init.sh
@@ -88,3 +88,29 @@ fi
 # Disable automatic updates (they compete with our scripts for the dpkg lock)
 sudo systemctl disable apt-daily.service
 sudo systemctl disable apt-daily.timer
+
+# ---------------------------------------------------------------------------
+# Not in install-guide:
+# Install mariadb-server from upstream repo (mariadb 10.1 shipping with
+# bionic breaks the neutron database upgrade process in OpenStack Train)
+# ---------------------------------------------------------------------------
+
+# Add mariadb repo
+cat << EOF | sudo tee /etc/apt/sources.list.d/mariadb.list
+# bionic mariadb 10.1 breaks neutron DB upgrade process in OpenStack Train
+deb http://downloads.mariadb.com/MariaDB/mariadb-10.3/repo/ubuntu bionic main
+EOF
+
+# Import key required for mariadb
+sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys F1656F24C74CD1D8
+
+# Update apt database for mariadb repo
+sudo apt update \
+    -o Dir::Etc::sourcelist="sources.list.d/mariadb.list" \
+    -o Dir::Etc::sourceparts="-" -o APT::Get::List-Cleanup="0"
+
+# Pre-configure database root password in /var/cache/debconf/passwords.dat
+# (the upstream mariadb-server has socket_auth disabled)
+source "$CONFIG_DIR/credentials"
+echo "mysql-server mysql-server/root_password password $DATABASE_PASSWORD" | sudo debconf-set-selections
+echo "mysql-server mysql-server/root_password_again password $DATABASE_PASSWORD" | sudo debconf-set-selections
diff --git a/labs/osbash/scripts/ubuntu/apt_install_mysql.sh b/labs/osbash/scripts/ubuntu/apt_install_mysql.sh
index 481a0e38..3a3d06d0 100755
--- a/labs/osbash/scripts/ubuntu/apt_install_mysql.sh
+++ b/labs/osbash/scripts/ubuntu/apt_install_mysql.sh
@@ -34,8 +34,8 @@ echo "Installing MySQL (MariaDB)."
 sudo apt install -y mariadb-server python-mysqldb
 
 # Not in the install-guide
-echo "Sanity check: distro default is socket auth."
-sudo mysql -u root -e quit
+echo "Sanity check: check if password login works for root."
+sudo mysql -u root -p"$DATABASE_PASSWORD" -e quit
 
 # Not in install-guide
 # To drop socket auth for root user and use root password: