diff --git a/apps/kimai/values.yaml b/apps/kimai/values.yaml
index b2912b8..4cce88d 100644
--- a/apps/kimai/values.yaml
+++ b/apps/kimai/values.yaml
@@ -23,6 +23,7 @@ mariadb:
   auth:
     existingSecret: kimai-secrets
     username: kimai
+    database: kimai
   primary:
     persistence:
       size: 4Gi
diff --git a/recon.sh b/recon.sh
new file mode 100755
index 0000000..a596e36
--- /dev/null
+++ b/recon.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+flux reconcile kustomization apps
+flux reconcile kustomization infrastructure
+flux reconcile kustomization secrets
+flux reconcile source git flux-system
diff --git a/secrets/kimaisecrets.yaml b/secrets/kimaisecrets.yaml
index ee2ffc8..0dada66 100644
--- a/secrets/kimaisecrets.yaml
+++ b/secrets/kimaisecrets.yaml
@@ -18,7 +18,11 @@ spec:
         app-secret: '{{ index . "kimai-admin-password" }}'
         admin-password: '{{ index . "kimai-admin-password" }}'
         mailer-url: 'null://localhost'
-        database-url: 'mysql://kimai:{{ index . "mariadb-password" }}@kimai-mariadb/kimai?charset=utf8&serverVersion=10.6'
+        # URL-encode DB password in case it contains reserved URI characters.
+        database-url: 'mysql://kimai:{{ index . "mariadb-password" | urlquery }}@kimai-mariadb/kimai?charset=utf8&serverVersion=10.6'
+        # Compatibility aliases used by some MariaDB chart versions.
+        password: '{{ index . "mariadb-password" }}'
+        root-password: '{{ index . "mariadb-root-password" }}'
   data:
     - secretKey: mariadb-root-password
       remoteRef: