diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index e20b522..67bd436 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -163,6 +163,8 @@ services:
       MARIADB_ROOT_PASSWORD: "${DB_ROOT_PASSWORD:?set DB_ROOT_PASSWORD in .env}"
     volumes:
       - mariadb-data:/var/lib/mysql
+      # Quiet the protocol-normal "Aborted connection" WARNINGs (log_warnings=1) + worker timeouts.
+      - ./docker/mariadb/tuning.cnf:/etc/mysql/conf.d/tuning.cnf:ro
     healthcheck:
       test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
       interval: 10s
diff --git a/docker-compose.yml b/docker-compose.yml
index e918e23..97dd90e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -81,6 +81,8 @@ services:
       MARIADB_ROOT_PASSWORD: "${DB_ROOT_PASSWORD:?set DB_ROOT_PASSWORD in .env}"
     volumes:
       - mariadb-data:/var/lib/mysql
+      # Quiet the protocol-normal "Aborted connection" WARNINGs (log_warnings=1) + worker timeouts.
+      - ./docker/mariadb/tuning.cnf:/etc/mysql/conf.d/tuning.cnf:ro
     ports:
       # localhost-only: reachable from the host (DB tools / SSH tunnel), not the whole network.
       - "127.0.0.1:${DB_PORT:-3306}:3306"
diff --git a/docker/mariadb/tuning.cnf b/docker/mariadb/tuning.cnf
new file mode 100644
index 0000000..f953272
--- /dev/null
+++ b/docker/mariadb/tuning.cnf
@@ -0,0 +1,16 @@
+[mysqld]
+# ── Connection-log noise ────────────────────────────────────────────────────────────────────
+# PHP/Laravel closes DB connections WITHOUT the MySQL COM_QUIT handshake whenever a long-lived
+# worker (queue:work / schedule:work / reverb:start) is recycled, a php-fpm worker is retired, or
+# a container restarts. MariaDB records each such disconnect as
+#   [Warning] Aborted connection ... (Got an error/timeout reading communication packets)
+# but ONLY at log_warnings >= 2 (the image default). These are protocol-normal — here ~2/day with
+# a non-persistent PDO pool and no connection leak — not a fault. Drop to level 1 so genuine errors
+# still log while the expected-disconnect noise stops. (The DB is bound to the internal network
+# only, so dropping the level-2 access-denied notes carries no real exposure.)
+log_warnings = 1
+
+# Give a momentarily-stalled read on a long-lived worker connection more slack before the server
+# aborts it, which further reduces the "timeout reading communication packets" variant. Job runtime
+# is already bounded by `queue:work --timeout=90`, so this only affects idle/stall tolerance.
+net_read_timeout = 120