diff --git a/.github/workflows/pr-php-tests.yml b/.github/workflows/pr-php-tests.yml
index 3129d845..2c177a46 100644
--- a/.github/workflows/pr-php-tests.yml
+++ b/.github/workflows/pr-php-tests.yml
@@ -36,6 +36,7 @@ jobs:
           - examples/composer
           - examples/db-client
           - examples/db-client-mysql
+          - examples/db-client-mysql57
           - examples/php-extensions
           - examples/xdebug
         lando-version:
diff --git a/builders/php.js b/builders/php.js
index 5ac1ced2..8a63dfce 100644
--- a/builders/php.js
+++ b/builders/php.js
@@ -68,12 +68,12 @@ const detectDatabaseClient = (options, debug = () => {}) => {
 
   for (const service of Object.values(services)) {
     const type = service?.type || '';
-    // Match mysql:X or recipe-mysql:X (e.g., backdrop-mysql:8.0, drupal-mysql:8.4)
-    const mysqlMatch = type.match(/(?:^|-)mysql:(\d+(?:\.\d+)?)/);
-    if (mysqlMatch && !mysqlVersion) mysqlVersion = mysqlMatch[1];
-    // Match mariadb:X or recipe-mariadb:X (e.g., backdrop-mariadb:10.6, drupal-mariadb:11.4)
-    const mariaMatch = type.match(/(?:^|-)mariadb:(\d+(?:\.\d+)?)/);
-    if (mariaMatch && !mariaVersion) mariaVersion = mariaMatch[1];
+    // Match mysql or mysql:X, including recipe prefixes (e.g., backdrop-mysql, backdrop-mysql:8.0)
+    const mysqlMatch = type.match(/(?:^|-)mysql(?::(\d+(?:\.\d+)?))?(?:$|[^a-z])/);
+    if (mysqlMatch && !mysqlVersion) mysqlVersion = mysqlMatch[1] || '8.0';
+    // Match mariadb or mariadb:X, including recipe prefixes (e.g., backdrop-mariadb:10.6)
+    const mariaMatch = type.match(/(?:^|-)mariadb(?::(\d+(?:\.\d+)?))?(?:$|[^a-z])/);
+    if (mariaMatch && !mariaVersion) mariaVersion = mariaMatch[1] || '11.4';
   }
 
   if (mariaVersion && mysqlVersion) {
diff --git a/examples/db-client-mysql57/.lando.yml b/examples/db-client-mysql57/.lando.yml
new file mode 100644
index 00000000..799fd868
--- /dev/null
+++ b/examples/db-client-mysql57/.lando.yml
@@ -0,0 +1,22 @@
+name: lando-php-db-client-mysql57
+
+services:
+  # Test MySQL 5.7 auto-detection with an appserver (not cli)
+  # Reproduces SSL errors when mysql commands run via services.run or events
+  appserver:
+    type: php:8.4
+    via: apache
+    run:
+      - mysql -h database -u testuser -ptestpass testdb -e "SELECT 1 AS connection_test"
+    run_as_root:
+      - mysql -h database -u root testdb -e "SELECT 1 AS root_connection_test"
+
+  database:
+    type: mysql:5.7
+    creds:
+      user: testuser
+      password: testpass
+      database: testdb
+
+plugins:
+  "@lando/php": ../..
diff --git a/examples/db-client-mysql57/README.md b/examples/db-client-mysql57/README.md
new file mode 100644
index 00000000..5ed8d1af
--- /dev/null
+++ b/examples/db-client-mysql57/README.md
@@ -0,0 +1,46 @@
+# Database Client MySQL 5.7 SSL Test
+
+This example tests that `db_client: auto` correctly handles MySQL 5.7 when using
+an Apache appserver with mysql commands in `services.run` (matching a real-world
+recipe scenario where SSL errors occur).
+
+## Start up tests
+
+Run the following commands to get up and running with this example.
+
+```bash
+# Should start up successfully with mysql run commands completing without SSL errors
+lando poweroff
+lando start
+```
+
+## Verification commands
+
+Run the following commands to validate things are rolling as they should.
+
+```bash
+# Auto-detection installs MySQL client (not MariaDB)
+lando exec appserver -- mysql --version | grep -q "mysql"
+lando exec appserver -- mysql --version | grep -qi "Ver 8.0"
+lando exec appserver -- mysql --version | grep -qiv "MariaDB"
+```
+
+```bash
+# MySQL client can connect to MySQL 5.7 database without SSL errors
+lando exec appserver -- mysql -h database -u testuser -ptestpass testdb -e "SELECT 1"
+```
+
+```bash
+# mysqldump works against MySQL 5.7 without SSL errors
+lando exec appserver -- mysqldump -h database -u testuser -ptestpass testdb --no-data > /dev/null
+```
+
+## Destroy tests
+
+Run the following commands to trash this app like nothing ever happened.
+
+```bash
+# Should be destroyed with success
+lando destroy -y
+lando poweroff
+```
diff --git a/scripts/mysql-client-install.sh b/scripts/mysql-client-install.sh
index 4d63e45d..6444d823 100755
--- a/scripts/mysql-client-install.sh
+++ b/scripts/mysql-client-install.sh
@@ -50,10 +50,15 @@ mkdir -p /etc/mysql/conf.d
 cat > /etc/mysql/conf.d/lando.cnf << 'MYCNF'
 [client]
 default-character-set=utf8mb4
+# Use PREFERRED so SSL is used when available but self-signed certs
+# (e.g. MySQL 5.7 defaults) don't cause verification failures.
+# Preserves SSL for servers that support it
+ssl-mode=PREFERRED
 
 [mysqldump]
 # Prevent column-statistics errors with newer mysqldump
 skip-column-statistics
+ssl-mode=PREFERRED
 MYCNF
 
 if ! mysql --version 2>/dev/null; then