diff --git a/changelog.d/20261104_130000_doug.goldstein_cinder_mariadb_operator_db_conn.md b/changelog.d/20261104_130000_doug.goldstein_cinder_mariadb_operator_db_conn.md
new file mode 100644
index 000000000..5efca8309
--- /dev/null
+++ b/changelog.d/20261104_130000_doug.goldstein_cinder_mariadb_operator_db_conn.md
@@ -0,0 +1,22 @@
+### Deploy repo changes
+
+Cinder now gets its `[database] connection` from the MariaDB operator instead of from the `CINDER_DB_PASSWORD` Helm value. The chart renders the `Database`, `User`, `Grant` and `Connection` resources, and the operator writes the connection string into the `cinder-db-conn` Secret, which is projected into every Cinder workload that talks to the database. `components/cinder/cinder-mariadb-db.yaml` is removed.
+
+The `cinder-db-password` Secret (`username` and `password` keys) is still read from your deploy repo, and the chart no longer renders it, so it must exist before this change syncs. Pods wait for `cinder-db-conn`, so a missing Secret shows up as pods stuck in `ContainerCreating`.
+
+Argo CD prunes the old `Grant` named `cinder-grant`; the chart's is named `cinder`. Check that both are Ready after the sync:
+
+```bash
+kubectl -n openstack get database,user,grant,connection -l application=cinder
+```
+
+The old `cinder-grant` can get stuck terminating. With `privileges: [ALL]` and `grantOption: true`, the operator's finalizer fails on delete with ``Error 1064 ... near 'ON `cinder`.* FROM 'cinder'@'%'' `` (seen on mariadb-operator 25.8.4). If `cinder-grant` is still present with a `deletionTimestamp`, revoke the privileges by hand and then remove the finalizer so the object can go away:
+
+```bash
+kubectl mariadb -n openstack mariadb -e "REVOKE ALL PRIVILEGES, GRANT OPTION FROM 'cinder'@'%';"
+kubectl -n openstack patch grant cinder-grant --type=merge -p '{"metadata":{"finalizers":null}}'
+```
+
+Patching the finalizer alone leaves the old grant in the database. The new `cinder` Grant re-applies the privileges for the same account.
+
+`CINDER_DB_PASSWORD` in `secret-openstack.yaml` is no longer used and can be removed from your deploy repo once every cluster is on this version.
diff --git a/charts/argocd-understack/values.yaml b/charts/argocd-understack/values.yaml
index 602fda85a..8b3a7286d 100644
--- a/charts/argocd-understack/values.yaml
+++ b/charts/argocd-understack/values.yaml
@@ -374,7 +374,7 @@ site:
     wave: 2
     # -- Chart version for Cinder
     # renovate: datasource=helm depName=cinder registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
-    chartVersion: 2026.1.73+a39ebbeb1
+    chartVersion: 2026.2.15+87bd2f7d3
 
   # -- Ironic (Bare Metal Service)
   ironic:
diff --git a/components/cinder/cinder-mariadb-db.yaml b/components/cinder/cinder-mariadb-db.yaml
deleted file mode 100644
index 5558acfec..000000000
--- a/components/cinder/cinder-mariadb-db.yaml
+++ /dev/null
@@ -1,52 +0,0 @@
----
-apiVersion: k8s.mariadb.com/v1alpha1
-kind: Database
-metadata:
-  name: cinder
-  namespace: openstack
-spec:
-  # If you want the database to be created with a different name than the resource name
-  # name: data-custom
-  mariaDbRef:
-    name: mariadb  # name of the MariaDB kind
-    waitForIt: true
-  characterSet: utf8
-  collate: utf8_general_ci
-  retryInterval: 5s
----
-apiVersion: k8s.mariadb.com/v1alpha1
-kind: User
-metadata:
-  name: cinder
-  namespace: openstack
-spec:
-  # If you want the user to be created with a different name than the resource name
-  # name: user-custom
-  mariaDbRef:
-    name: mariadb  # name of the MariaDB kind
-    waitForIt: true
-  passwordSecretKeyRef:
-    name: cinder-db-password
-    key: password
-  # This field is immutable and defaults to 10, 0 means unlimited.
-  maxUserConnections: 0
-  host: "%"
-  retryInterval: 5s
----
-apiVersion: k8s.mariadb.com/v1alpha1
-kind: Grant
-metadata:
-  name: cinder-grant
-  namespace: openstack
-spec:
-  mariaDbRef:
-    name: mariadb  # name of the MariaDB kind
-    waitForIt: true
-  privileges:
-    - "ALL"
-  database: "cinder"
-  table: "*"
-  username: cinder
-  grantOption: true
-  host: "%"
-  retryInterval: 5s
diff --git a/components/cinder/kustomization.yaml b/components/cinder/kustomization.yaml
index 2c03b4709..54a9d2dcb 100644
--- a/components/cinder/kustomization.yaml
+++ b/components/cinder/kustomization.yaml
@@ -3,5 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - cinder-mariadb-db.yaml
   - cinder-rabbitmq-queue.yaml
diff --git a/components/cinder/values.yaml b/components/cinder/values.yaml
index 93de8ec92..5a94bde7a 100644
--- a/components/cinder/values.yaml
+++ b/components/cinder/values.yaml
@@ -14,6 +14,11 @@ conf:
       volume_backend_name: netapp_nvme
       volume_driver: cinder_understack.dynamic_netapp_driver.NetappCinderDynamicDriver
   cinder:
+    database:
+      # The MariaDB operator writes the connection string into the
+      # cinder-db-conn secret, which the chart projects into the config
+      # directory, so the chart must not generate one from the DB password.
+      connection: null
     DEFAULT:
       enabled_backends: netapp_nvme
       default_volume_type: __DEFAULT__
@@ -182,13 +187,26 @@ dependencies:
       services: []
 
 
+# The chart declares the Database, User, Grant and Connection resources instead
+# of the db-init job. The password is read from the cinder-db-password secret
+# in the deploy repo rather than rendered from Helm values.
+mariadb_db:
+  api_group: k8s.mariadb.com
+  # the MariaDB resource is named mariadb, while clients connect through the
+  # mariadb-primary service set in endpoints.oslo_db.hosts
+  mariadb_ref: mariadb
+  password_secret:
+    create: false
+
 manifests:
   job_backup_storage_init: false
   job_bootstrap: false
   job_clean: false
   job_db_init: false
   job_db_drop: false
+  mariadb_db: true
   job_rabbit_init: false
+  rabbitmq_topology: false
   job_storage_init: false
   pod_rally_test: false
   secret_db: false
diff --git a/components/openstack-secrets.tpl.yaml b/components/openstack-secrets.tpl.yaml
index b9d9eb5fe..a1209be67 100644
--- a/components/openstack-secrets.tpl.yaml
+++ b/components/openstack-secrets.tpl.yaml
@@ -30,9 +30,6 @@ endpoints:
       # this is what the horizon dashboard service uses to connect to MariaDB
       horizon:
         password: "${HORIZON_DB_PASSWORD}"
-      # this is what the cinder service uses to connect to MariaDB
-      cinder:
-        password: "${CINDER_DB_PASSWORD}"
       # this is what the octavia service uses to connect to MariaDB
       octavia:
         password: "${OCTAVIA_DB_PASSWORD}"