diff --git a/pkgs/servers/sql/mariadb/cmake-disable-auth-pam-testing.patch b/pkgs/servers/sql/mariadb/cmake-disable-auth-pam-testing.patch
new file mode 100644
index 00000000000..864ee818d3c
--- /dev/null
+++ b/pkgs/servers/sql/mariadb/cmake-disable-auth-pam-testing.patch
@@ -0,0 +1,12 @@
+diff --git a/plugin/auth_pam/CMakeLists.txt b/plugin/auth_pam/CMakeLists.txt
+index a556b870..918a26f9 100644
+--- a/plugin/auth_pam/CMakeLists.txt
++++ b/plugin/auth_pam/CMakeLists.txt
+@@ -22,7 +22,6 @@ IF(HAVE_PAM_APPL_H)
+                    COMPONENT Server)
+   ENDIF()
+   IF(TARGET auth_pam OR TARGET auth_pam_v1)
+-    ADD_SUBDIRECTORY(testing)
+     ADD_LIBRARY(pam_user_map MODULE mapper/pam_user_map.c)
+     TARGET_LINK_LIBRARIES(pam_user_map pam)
+     SET_TARGET_PROPERTIES (pam_user_map PROPERTIES PREFIX "")
diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index 9b5118eacc3..ac9772922ec 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -23,14 +23,14 @@ mariadb = server // {
 };
 
 common = rec { # attributes common to both builds
-  version = "10.3.22";
+  version = "10.4.12";
 
   src = fetchurl {
     urls = [
       "https://downloads.mariadb.org/f/mariadb-${version}/source/mariadb-${version}.tar.gz"
       "https://downloads.mariadb.com/MariaDB/mariadb-${version}/source/mariadb-${version}.tar.gz"
     ];
-    sha256 = "1iyf1hl82nqsci5h327a537rvdrc5qcbrd1v3fc4cxy2pmfha01j";
+    sha256 = "0252b9rxxz1ljjv6ni0wwgy14j8qmmdd2sq0a65dslx2ib9y3wgy";
     name   = "mariadb-${version}.tar.gz";
   };
 
@@ -111,7 +111,6 @@ common = rec { # attributes common to both builds
   };
 
   meta = {
-
     description = "An enhanced, drop-in replacement for MySQL";
     homepage    = "https://mariadb.org/";
     license     = licenses.gpl2;
@@ -161,7 +160,10 @@ server = stdenv.mkDerivation (common // {
     ++ optional stdenv.hostPlatform.isLinux linux-pam
     ++ optional (!stdenv.hostPlatform.isDarwin) mytopEnv;
 
-  patches = common.patches ++ optionals stdenv.hostPlatform.isDarwin [
+  patches = common.patches ++ [
+    # Disable build unused plugin pam_mariadb_mtr.so. See https://jira.mariadb.org/browse/MDEV-21654
+    ./cmake-disable-auth-pam-testing.patch
+  ] ++ optionals stdenv.hostPlatform.isDarwin [
     ./cmake-without-plugin-auth-pam.patch
   ];
 
@@ -198,7 +200,7 @@ server = stdenv.mkDerivation (common // {
 
   postInstall = common.postInstall + ''
     chmod +x "$out"/bin/wsrep_sst_common
-    rm "$out"/bin/{mysql_client_test,mysqltest}
+    rm "$out"/bin/{mariadb-client-test,mariadb-test,mysql_client_test,mysqltest}
     rm -r "$out"/data # Don't need testing data
   '' + optionalString withStorageMroonga ''
     mv "$out"/share/{groonga,groonga-normalizer-mysql} "$out"/share/doc/mysql