diff --git a/data/Dockerfiles/dovecot/Dockerfile b/data/Dockerfiles/dovecot/Dockerfile
index f1152c8a1..b7c6e9403 100644
--- a/data/Dockerfiles/dovecot/Dockerfile
+++ b/data/Dockerfiles/dovecot/Dockerfile
@@ -1,4 +1,36 @@
-FROM alpine:3.21
+# Alpine >= 3.22 only ships Dovecot 2.4, Dovecot 2.3 is built from the Alpine 3.21 packaging
+FROM alpine:3.24 AS builder
+
+# Last commit of the aports 3.21-stable branch
+ARG APORTS_COMMIT=55126a11a4b9dcd14de3068e3348e9951d144ca6
+
+RUN apk add --no-cache alpine-sdk git \
+  && git init -q /aports \
+  && cd /aports \
+  && git remote add origin https://github.com/alpinelinux/aports.git \
+  && git sparse-checkout set main/dovecot community/dovecot-fts-flatcurve \
+  && git fetch -q --depth 1 --filter=blob:none origin ${APORTS_COMMIT} \
+  && git checkout -q FETCH_HEAD \
+  && abuild-keygen -a -n \
+  && cp /root/.abuild/*.rsa.pub /etc/apk/keys/ \
+  && apk update \
+  && cd /aports/main/dovecot \
+  # newer gettext does not overwrite the shipped config.rpath without -f
+  && sed -i 's/autoreconf -vi/autoreconf -fvi/' APKBUILD \
+  && abuild -F -r \
+  # flatcurve must be built against the Dovecot 2.3 headers
+  && apk add --no-cache /root/packages/main/*/dovecot-2*.apk /root/packages/main/*/dovecot-dev-*.apk \
+  && cd /aports/community/dovecot-fts-flatcurve \
+  && abuild -F -r \
+  && mkdir /packages \
+  && cp /root/.abuild/*.rsa.pub /packages/ \
+  && for pkg in dovecot dovecot-dev dovecot-lmtpd dovecot-lua dovecot-ldap dovecot-mysql dovecot-sql \
+    dovecot-submissiond dovecot-pigeonhole-plugin dovecot-pop3d dovecot-fts-flatcurve; do \
+    cp /root/packages/*/*/${pkg}-[0-9]*.apk /packages/; \
+  done
+
+
+FROM alpine:3.24
 
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"
 
@@ -7,6 +39,10 @@ ARG GOSU_VERSION=1.19
 
 ENV LANG=C.UTF-8
 ENV LC_ALL=C.UTF-8
+# MariaDB Connector/C >= 3.4 refuses DB servers without TLS, this covers Perl DBI, client.cnf covers Dovecot
+ENV MARIADB_TLS_DISABLE_PEER_VERIFICATION=1
+
+COPY --from=builder /packages /tmp/packages
 
 # Add groups and users before installing Dovecot to not break compatibility
 RUN addgroup -g 5000 vmail \
@@ -18,6 +54,7 @@ RUN addgroup -g 5000 vmail \
   && adduser -D -u 5000 -G vmail -h /var/vmail vmail \
   && adduser -D -G dovecot -u 401 -h /dev/null -s /sbin/nologin dovecot \
   && adduser -D -G dovenull -u 402 -h /dev/null -s /sbin/nologin dovenull \
+  && cp /tmp/packages/*.rsa.pub /etc/apk/keys/ \
   && apk add --no-cache --update \
   bash \
   bind-tools \
@@ -99,22 +136,15 @@ RUN addgroup -g 5000 vmail \
   supervisor \
   tzdata \
   wget \
-  dovecot \
-  dovecot-dev \
-  dovecot-lmtpd \
-  dovecot-lua \
-  dovecot-ldap \
-  dovecot-mysql \
-  dovecot-sql \
-  dovecot-submissiond \
-  dovecot-pigeonhole-plugin \
-  dovecot-pop3d \
-  dovecot-fts-flatcurve \
+  /tmp/packages/*.apk \
+  && rm -rf /tmp/packages \
   && arch=$(arch | sed s/aarch64/arm64/ | sed s/x86_64/amd64/) \
   && wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$arch" \
   && chmod +x /usr/local/bin/gosu \
   && gosu nobody true
 
+# Dovecot's MySQL driver reads [client] from /etc/my.cnf, Connector/C ignores the !includedir there
+COPY client.cnf /etc/my.cnf
 COPY trim_logs.sh /usr/local/bin/trim_logs.sh
 COPY clean_q_aged.sh /usr/local/bin/clean_q_aged.sh
 COPY syslog-ng.conf /etc/syslog-ng/syslog-ng.conf
diff --git a/data/Dockerfiles/dovecot/client.cnf b/data/Dockerfiles/dovecot/client.cnf
new file mode 100644
index 000000000..f078f3cbe
--- /dev/null
+++ b/data/Dockerfiles/dovecot/client.cnf
@@ -0,0 +1,3 @@
+[client]
+ssl = false
+ssl-verify-server-cert = false