diff --git a/helm/ezscale-website/templates/mariadb-database.yaml b/helm/ezscale-website/templates/mariadb-database.yaml
new file mode 100644
index 0000000..b6e833b
--- /dev/null
+++ b/helm/ezscale-website/templates/mariadb-database.yaml
@@ -0,0 +1,16 @@
+apiVersion: k8s.mariadb.com/v1alpha1
+kind: Database
+metadata:
+  name: {{ include "ezscale-website.fullname" . }}-db
+  labels: {{- include "ezscale-website.labels" . | nindent 4 }}
+spec:
+  mariaDbRef:
+    {{- if .Values.mariadb.enabled }}
+    name: {{ include "ezscale-website.fullname" . }}-mariadb
+    {{- else }}
+    name: {{ .Values.mariadb.externalRef.name }}
+    namespace: {{ .Values.mariadb.externalRef.namespace }}
+    {{- end }}
+  characterSet: utf8mb4
+  collate: utf8mb4_unicode_ci
+  name: {{ .Values.mariadb.database }}
diff --git a/helm/ezscale-website/templates/mariadb-grant.yaml b/helm/ezscale-website/templates/mariadb-grant.yaml
new file mode 100644
index 0000000..cb2b213
--- /dev/null
+++ b/helm/ezscale-website/templates/mariadb-grant.yaml
@@ -0,0 +1,19 @@
+apiVersion: k8s.mariadb.com/v1alpha1
+kind: Grant
+metadata:
+  name: {{ include "ezscale-website.fullname" . }}-grant
+  labels: {{- include "ezscale-website.labels" . | nindent 4 }}
+spec:
+  mariaDbRef:
+    {{- if .Values.mariadb.enabled }}
+    name: {{ include "ezscale-website.fullname" . }}-mariadb
+    {{- else }}
+    name: {{ .Values.mariadb.externalRef.name }}
+    namespace: {{ .Values.mariadb.externalRef.namespace }}
+    {{- end }}
+  username: {{ .Values.mariadb.username }}
+  host: "%"
+  privileges:
+    - "ALL PRIVILEGES"
+  database: {{ .Values.mariadb.database }}
+  table: "*"
diff --git a/helm/ezscale-website/templates/mariadb-user.yaml b/helm/ezscale-website/templates/mariadb-user.yaml
new file mode 100644
index 0000000..723fa37
--- /dev/null
+++ b/helm/ezscale-website/templates/mariadb-user.yaml
@@ -0,0 +1,21 @@
+apiVersion: k8s.mariadb.com/v1alpha1
+kind: User
+metadata:
+  name: {{ include "ezscale-website.fullname" . }}-user
+  labels: {{- include "ezscale-website.labels" . | nindent 4 }}
+spec:
+  # spec.name overrides metadata.name as the SQL identifier — needed because
+  # k8s resource names can't contain underscores but our SQL username can.
+  name: {{ .Values.mariadb.username }}
+  mariaDbRef:
+    {{- if .Values.mariadb.enabled }}
+    name: {{ include "ezscale-website.fullname" . }}-mariadb
+    {{- else }}
+    name: {{ .Values.mariadb.externalRef.name }}
+    namespace: {{ .Values.mariadb.externalRef.namespace }}
+    {{- end }}
+  passwordSecretKeyRef:
+    name: {{ include "ezscale-website.secretName" . }}
+    key: DB_PASSWORD
+  host: "%"
+  maxUserConnections: 50