diff --git a/packages/apps/mariadb/templates/certmanager.yaml b/packages/apps/mariadb/templates/certmanager.yaml
index 1996fd426..9547283c0 100644
--- a/packages/apps/mariadb/templates/certmanager.yaml
+++ b/packages/apps/mariadb/templates/certmanager.yaml
@@ -29,8 +29,8 @@ spec:
     group: cert-manager.io
   privateKey:
     rotationPolicy: Never
-    algorithm: RSA
-    size: 4096
+    algorithm: ECDSA
+    size: 256
   # CA usages: signing + cert sign (issuing leaf certs) + crl sign (RFC 5280)
   usages:
     - signing
@@ -83,8 +83,8 @@ spec:
     {{- end }}
   privateKey:
     rotationPolicy: Always
-    algorithm: RSA
-    size: 4096
+    algorithm: ECDSA
+    size: 256
   issuerRef:
     name: {{ .Release.Name }}-ca
     kind: Issuer
diff --git a/packages/apps/mariadb/tests/tls_test.yaml b/packages/apps/mariadb/tests/tls_test.yaml
index c7d15bec8..f2050de57 100644
--- a/packages/apps/mariadb/tests/tls_test.yaml
+++ b/packages/apps/mariadb/tests/tls_test.yaml
@@ -714,3 +714,62 @@ tests:
       - contains:
           path: spec.dnsNames
           content: "*.my-mariadb-internal"
+
+  # -------------------------------------------------------------------
+  # ECDSA: CA and leaf use ECDSA P-256
+  # Smaller keys, faster handshakes, stronger per-bit security than RSA.
+  # rotationPolicy preserved: Never for CA, Always for leaf.
+  # -------------------------------------------------------------------
+  - it: "CA cert uses ECDSA P-256 algorithm"
+    templates:
+      - templates/certmanager.yaml
+    set:
+      tls:
+        enabled: true
+    documentIndex: 1
+    asserts:
+      - equal:
+          path: spec.privateKey.algorithm
+          value: ECDSA
+      - equal:
+          path: spec.privateKey.size
+          value: 256
+
+  - it: "leaf cert uses ECDSA P-256 algorithm"
+    templates:
+      - templates/certmanager.yaml
+    set:
+      tls:
+        enabled: true
+    documentIndex: 3
+    asserts:
+      - equal:
+          path: spec.privateKey.algorithm
+          value: ECDSA
+      - equal:
+          path: spec.privateKey.size
+          value: 256
+
+  - it: "CA cert rotationPolicy is Never (ECDSA)"
+    templates:
+      - templates/certmanager.yaml
+    set:
+      tls:
+        enabled: true
+    documentIndex: 1
+    asserts:
+      - equal:
+          path: spec.privateKey.rotationPolicy
+          value: Never
+
+  - it: "leaf cert rotationPolicy is Always (ECDSA)"
+    templates:
+      - templates/certmanager.yaml
+    set:
+      tls:
+        enabled: true
+    documentIndex: 3
+    asserts:
+      - equal:
+          path: spec.privateKey.rotationPolicy
+          value: Always