diff --git a/packages/core/platform/templates/apps.yaml b/packages/core/platform/templates/apps.yaml
index 030cfe8b2..4a0f0ae89 100644
--- a/packages/core/platform/templates/apps.yaml
+++ b/packages/core/platform/templates/apps.yaml
@@ -33,6 +33,14 @@ stringData:
     opensearch-operator:
       manager:
         dnsBase: {{ .Values.networking.clusterDomain | quote }}
+    {{- /*
+      The operator resolves its own MariaDB pods, and the webhook certificate
+      gets its SAN, from CLUSTER_NAME, which the vendored subchart reads from
+      clusterName. Same subchart-key route as above; a package rendered
+      without this Secret falls back to the literal in its values.yaml.
+    */}}
+    mariadb-operator:
+      clusterName: {{ .Values.networking.clusterDomain | quote }}
     _cluster:
       root-host: {{ $rootHost | quote }}
       bundle-name: {{ .Values.bundles.system.variant | quote }}
diff --git a/packages/core/platform/tests/apps_mariadb_operator_cluster_name_test.yaml b/packages/core/platform/tests/apps_mariadb_operator_cluster_name_test.yaml
new file mode 100644
index 000000000..6cd9426ba
--- /dev/null
+++ b/packages/core/platform/tests/apps_mariadb_operator_cluster_name_test.yaml
@@ -0,0 +1,33 @@
+suite: apps.yaml networking.clusterDomain reaches the mariadb-operator cluster name
+
+templates:
+  - templates/apps.yaml
+
+release:
+  name: cozy-platform
+  namespace: cozy-system
+
+# The operator dials <primary>.<ns>.svc.<CLUSTER_NAME> to set up replication and
+# to reconcile User, Database and Grant, and the vendored subchart fills
+# CLUSTER_NAME from clusterName. A cluster whose domain is not cozy.local got
+# NXDOMAIN on every such lookup while the literal was pinned in the package.
+# Every pattern anchors clusterName to its mariadb-operator parent, so a sibling
+# block carrying the same domain cannot satisfy the assertion on its own.
+
+tests:
+  - it: carries the cozy.local default under the subchart key
+    asserts:
+      - matchRegex:
+          path: stringData["values.yaml"]
+          pattern: '(?m)^mariadb-operator:\n  clusterName: "cozy\.local"$'
+
+  - it: tracks a non-default networking.clusterDomain
+    set:
+      networking.clusterDomain: example.test
+    asserts:
+      - matchRegex:
+          path: stringData["values.yaml"]
+          pattern: '(?m)^mariadb-operator:\n  clusterName: "example\.test"$'
+      - notMatchRegex:
+          path: stringData["values.yaml"]
+          pattern: '(?m)^mariadb-operator:\n  clusterName: "cozy\.local"$'
diff --git a/packages/system/mariadb-operator/tests/cluster_name_test.yaml b/packages/system/mariadb-operator/tests/cluster_name_test.yaml
new file mode 100644
index 000000000..45d762727
--- /dev/null
+++ b/packages/system/mariadb-operator/tests/cluster_name_test.yaml
@@ -0,0 +1,43 @@
+suite: mariadb-operator package resolves its pods in the platform cluster domain
+release:
+  name: mariadb-operator
+  namespace: cozy-mariadb-operator
+# core/platform hands the cluster domain to this package as
+# mariadb-operator.clusterName in the shared values Secret. Guard that the
+# vendored chart still threads that key into what the operator and the webhook
+# certificate use, so a re-vendor that renames it goes red here.
+tests:
+  - it: sets the operator CLUSTER_NAME from the injected domain
+    templates:
+      - charts/mariadb-operator/templates/operator/deployment.yaml
+    set:
+      mariadb-operator.clusterName: example.test
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: CLUSTER_NAME
+            value: example.test
+
+  - it: issues the webhook certificate for the injected domain
+    templates:
+      - charts/mariadb-operator/templates/webhook/certificate.yaml
+    documentSelector:
+      path: kind
+      value: Certificate
+    set:
+      mariadb-operator.clusterName: example.test
+    asserts:
+      - contains:
+          path: spec.dnsNames
+          content: mariadb-operator-webhook.cozy-mariadb-operator.svc.example.test
+
+  - it: keeps cozy.local as the standalone default
+    templates:
+      - charts/mariadb-operator/templates/operator/deployment.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: CLUSTER_NAME
+            value: cozy.local
diff --git a/packages/system/mariadb-operator/values.yaml b/packages/system/mariadb-operator/values.yaml
index 2728c084e..285975440 100644
--- a/packages/system/mariadb-operator/values.yaml
+++ b/packages/system/mariadb-operator/values.yaml
@@ -1,4 +1,6 @@
 mariadb-operator:
+  # Fallback only: core/platform injects networking.clusterDomain into this key
+  # through the shared cozystack-values Secret (see its apps.yaml).
   clusterName: cozy.local
   metrics:
     enabled: true