diff --git a/debian/additions/mariadb.cnf b/debian/additions/mariadb.cnf
index da21212faef..c6fb2f781a2 100644
--- a/debian/additions/mariadb.cnf
+++ b/debian/additions/mariadb.cnf
@@ -1,19 +1,23 @@
-# MariaDB-specific config file.
-# Read by /etc/mysql/my.cnf
-
-[client]
-# Default is Latin1, if you need UTF-8 set this (also in server section)
-#default-character-set = utf8 
-
-[mysqld]
+# The MariaDB configuration file
 #
-# * Character sets
-# 
-# Default is Latin1, if you need UTF-8 set all this (also in client section)
+# The MariaDB/MySQL tools read configuration files in the following order:
+# 1. "/etc/mysql/mariadb.cnf" (this file) to set global defaults,
+# 2. "/etc/mysql/conf.d/*.cnf" to set global options.
+# 3. "/etc/mysql/mariadb.conf.d/*.cnf" to set MariaDB-only options.
+# 4. "~/.my.cnf" to set user-specific options.
 #
-#character-set-server  = utf8 
-#collation-server      = utf8_general_ci 
-#character_set_server   = utf8 
-#collation_server       = utf8_general_ci 
+# If the same option is defined multiple times, the last one will apply.
+#
+# One can use all long options that the program supports.
+# Run program with --help to get a list of available options and with
+# --print-defaults to see which it would actually understand and use.
+
+#
+# This group is read both by the client and the server
+# use it for options that affect everything
+#
+[client-server]
+
 # Import all .cnf files from configuration directory
+!includedir /etc/mysql/conf.d/
 !includedir /etc/mysql/mariadb.conf.d/
diff --git a/debian/additions/mariadb.conf.d/50-client.cnf b/debian/additions/mariadb.conf.d/50-client.cnf
new file mode 100644
index 00000000000..b509f191047
--- /dev/null
+++ b/debian/additions/mariadb.conf.d/50-client.cnf
@@ -0,0 +1,25 @@
+#
+# This group is read by the client library
+# Use it for options that affect all clients, but not the server
+#
+
+[client]
+# Default is Latin1, if you need UTF-8 set this (also in server section)
+default-character-set = utf8mb4
+
+# socket location
+socket = /var/run/mysqld/mysqld.sock
+
+# Example of client certificate usage
+# ssl-cert=/etc/mysql/client-cert.pem
+# ssl-key=/etc/mysql/client-key.pem
+#
+# Allow only TLS encrypted connections
+# ssl-verify-server-cert=on
+
+# This group is *never* read by mysql client library, though this
+# /etc/mysql/mariadb.cnf.d/client.cnf file is not read by Oracle MySQL
+# client anyway.
+# If you use the same .cnf file for MySQL and MariaDB,
+# use it for MariaDB-only client options
+[client-mariadb]
diff --git a/debian/additions/mariadb.conf.d/50-mysql-clients.cnf b/debian/additions/mariadb.conf.d/50-mysql-clients.cnf
new file mode 100644
index 00000000000..55cfda26158
--- /dev/null
+++ b/debian/additions/mariadb.conf.d/50-mysql-clients.cnf
@@ -0,0 +1,24 @@
+#
+# These groups are read by MariaDB command-line tools
+# Use it for options that affect only one utility
+#
+
+[mysql]
+# Default is Latin1, if you need UTF-8 set this (also in server section)
+default-character-set = utf8mb4
+
+[mysql_upgrade]
+
+[mysqladmin]
+
+[mysqlbinlog]
+
+[mysqlcheck]
+
+[mysqldump]
+
+[mysqlimport]
+
+[mysqlshow]
+
+[mysqlslap]
diff --git a/debian/additions/mariadb.conf.d/50-mysqld_safe.cnf b/debian/additions/mariadb.conf.d/50-mysqld_safe.cnf
new file mode 100644
index 00000000000..141d51f61a2
--- /dev/null
+++ b/debian/additions/mariadb.conf.d/50-mysqld_safe.cnf
@@ -0,0 +1,30 @@
+# NOTE: This file is read only by the traditional SysV init script, not systemd.
+# MariaDB systemd does _not_ utilize mysqld_safe nor read this file.
+#
+# For similar behaviour, systemd users should create the following file:
+# /etc/systemd/system/mariadb.service.d/migrated-from-my.cnf-settings.conf
+#
+# To achieve the same result as the default 50-mysqld_safe.cnf, please create
+# /etc/systemd/system/mariadb.service.d/migrated-from-my.cnf-settings.conf
+# with the following contents:
+#
+# [Service]
+# User=mysql
+# StandardOutput=syslog
+# StandardError=syslog
+# SyslogFacility=daemon
+# SyslogLevel=err
+# SyslogIdentifier=mysqld
+#
+# For more information, please read https://mariadb.com/kb/en/mariadb/systemd/
+#
+
+[mysqld_safe]
+# This will be passed to all mysql clients
+# It has been reported that passwords should be enclosed with ticks/quotes
+# especially if they contain "#" chars...
+# Remember to edit /etc/mysql/debian.cnf when changing the socket location.
+socket		= /var/run/mysqld/mysqld.sock
+nice		= 0
+skip_log_error
+syslog
diff --git a/debian/additions/mariadb.conf.d/50-server.cnf b/debian/additions/mariadb.conf.d/50-server.cnf
new file mode 100644
index 00000000000..3c39e92bd7d
--- /dev/null
+++ b/debian/additions/mariadb.conf.d/50-server.cnf
@@ -0,0 +1,133 @@
+#
+# These groups are read by MariaDB server.
+# Use it for options that only the server (but not clients) should see
+#
+# See the examples of server my.cnf files in /usr/share/mysql
+
+# this is read by the standalone daemon and embedded servers
+[server]
+
+# this is only for the mysqld standalone daemon
+[mysqld]
+
+#
+# * Basic Settings
+#
+user                    = mysql
+pid-file                = /run/mysqld/mysqld.pid
+socket                  = /run/mysqld/mysqld.sock
+#port                   = 3306
+basedir                 = /usr
+datadir                 = /var/lib/mysql
+tmpdir                  = /tmp
+lc-messages-dir         = /usr/share/mysql
+#skip-external-locking
+
+# Instead of skip-networking the default is now to listen only on
+# localhost which is more compatible and is not less secure.
+bind-address            = 127.0.0.1
+
+#
+# * Fine Tuning
+#
+#key_buffer_size        = 16M
+#max_allowed_packet     = 16M
+#thread_stack           = 192K
+#thread_cache_size      = 8
+# This replaces the startup script and checks MyISAM tables if needed
+# the first time they are touched
+#myisam_recover_options = BACKUP
+#max_connections        = 100
+#table_cache            = 64
+#thread_concurrency     = 10
+
+#
+# * Query Cache Configuration
+#
+#query_cache_limit      = 1M
+query_cache_size        = 16M
+
+#
+# * Logging and Replication
+#
+# Both location gets rotated by the cronjob.
+# Be aware that this log type is a performance killer.
+# As of 5.1 you can enable the log at runtime!
+#general_log_file       = /var/log/mysql/mysql.log
+#general_log            = 1
+#
+# Error log - should be very few entries.
+#
+log_error = /var/log/mysql/error.log
+#
+# Enable the slow query log to see queries with especially long duration
+#slow_query_log_file    = /var/log/mysql/mariadb-slow.log
+#long_query_time        = 10
+#log_slow_rate_limit    = 1000
+#log_slow_verbosity     = query_plan
+#log-queries-not-using-indexes
+#
+# The following can be used as easy to replay backup logs or for replication.
+# note: if you are setting up a replication slave, see README.Debian about
+#       other settings you may need to change.
+#server-id              = 1
+#log_bin                = /var/log/mysql/mysql-bin.log
+expire_logs_days        = 10
+#max_binlog_size        = 100M
+#binlog_do_db           = include_database_name
+#binlog_ignore_db       = exclude_database_name
+
+#
+# * Security Features
+#
+# Read the manual, too, if you want chroot!
+#chroot = /var/lib/mysql/
+#
+# For generating SSL certificates you can use for example the GUI tool "tinyca".
+#
+#ssl-ca = /etc/mysql/cacert.pem
+#ssl-cert = /etc/mysql/server-cert.pem
+#ssl-key = /etc/mysql/server-key.pem
+#
+# Accept only connections using the latest and most secure TLS protocol version.
+# ..when MariaDB is compiled with OpenSSL:
+#ssl-cipher = TLSv1.2
+# ..when MariaDB is compiled with YaSSL (default in Debian):
+#ssl = on
+
+#
+# * Character sets
+#
+# MySQL/MariaDB default is Latin1, but in Debian we rather default to the full
+# utf8 4-byte character set. See also client.cnf
+#
+character-set-server  = utf8mb4
+collation-server      = utf8mb4_general_ci
+
+#
+# * InnoDB
+#
+# InnoDB is enabled by default with a 10MB datafile in /var/lib/mysql/.
+# Read the manual for more InnoDB related options. There are many!
+
+#
+# * Unix socket authentication plugin is built-in since 10.0.22-6
+#
+# Needed so the root database user can authenticate without a password but
+# only when running as the unix root user.
+#
+# Also available for other users if required.
+# See https://mariadb.com/kb/en/unix_socket-authentication-plugin/
+
+# this is only for embedded server
+[embedded]
+
+# This group is only read by MariaDB servers, not by MySQL.
+# If you use the same .cnf file for MySQL and MariaDB,
+# you can put MariaDB-only options here
+[mariadb]
+
+# This group is only read by MariaDB-10.5 servers.
+# If you use the same .cnf file for MariaDB of different versions,
+# use this group for options that older servers don't understand
+[mariadb-10.5]
diff --git a/debian/additions/mariadb.conf.d/60-galera.cnf b/debian/additions/mariadb.conf.d/60-galera.cnf
new file mode 100644
index 00000000000..7249a0f1ec8
--- /dev/null
+++ b/debian/additions/mariadb.conf.d/60-galera.cnf
@@ -0,0 +1,19 @@
+#
+# * Galera-related settings
+#
+[galera]
+# Mandatory settings
+#wsrep_on=ON
+#wsrep_provider=
+#wsrep_cluster_address=
+#binlog_format=row
+#default_storage_engine=InnoDB
+#innodb_autoinc_lock_mode=2
+#
+# Allow server to accept connections on all interfaces.
+#
+#bind-address=0.0.0.0
+#
+# Optional setting
+#wsrep_slave_threads=1
+#innodb_flush_log_at_trx_commit=0
diff --git a/debian/additions/my.cnf b/debian/additions/my.cnf
deleted file mode 100644
index 77596bc308b..00000000000
--- a/debian/additions/my.cnf
+++ /dev/null
@@ -1,188 +0,0 @@
-# MariaDB database server configuration file.
-#
-# You can copy this file to one of:
-# - "/etc/mysql/my.cnf" to set global options,
-# - "~/.my.cnf" to set user-specific options.
-# 
-# One can use all long options that the program supports.
-# Run program with --help to get a list of available options and with
-# --print-defaults to see which it would actually understand and use.
-#
-# For explanations see
-# http://dev.mysql.com/doc/mysql/en/server-system-variables.html
-
-# This will be passed to all mysql clients
-# It has been reported that passwords should be enclosed with ticks/quotes
-# escpecially if they contain "#" chars...
-# Remember to edit /etc/mysql/debian.cnf when changing the socket location.
-[client]
-port		= 3306
-socket		= /var/run/mysqld/mysqld.sock
-
-# Here is entries for some specific programs
-# The following values assume you have at least 32M ram
-
-# This was formally known as [safe_mysqld]. Both versions are currently parsed.
-[mysqld_safe]
-socket		= /var/run/mysqld/mysqld.sock
-nice		= 0
-
-[mysqld]
-#
-# * Basic Settings
-#
-user		= mysql
-pid-file	= /var/run/mysqld/mysqld.pid
-socket		= /var/run/mysqld/mysqld.sock
-port		= 3306
-basedir		= /usr
-datadir		= /var/lib/mysql
-tmpdir		= /tmp
-lc_messages_dir	= /usr/share/mysql
-lc_messages	= en_US
-skip-external-locking
-#
-# Instead of skip-networking the default is now to listen only on
-# localhost which is more compatible and is not less secure.
-bind-address		= 127.0.0.1
-#
-# * Fine Tuning
-#
-max_connections		= 100
-connect_timeout		= 5
-wait_timeout		= 600
-max_allowed_packet	= 16M
-thread_cache_size       = 128
-sort_buffer_size	= 4M
-bulk_insert_buffer_size	= 16M
-tmp_table_size		= 32M
-max_heap_table_size	= 32M
-#
-# * MyISAM
-#
-# This replaces the startup script and checks MyISAM tables if needed
-# the first time they are touched. On error, make copy and try a repair.
-myisam_recover_options = BACKUP
-key_buffer_size		= 128M
-#open-files-limit	= 2000
-table_open_cache	= 400
-myisam_sort_buffer_size	= 512M
-concurrent_insert	= 2
-read_buffer_size	= 2M
-read_rnd_buffer_size	= 1M
-#
-# * Query Cache Configuration
-#
-# Cache only tiny result sets, so we can fit more in the query cache.
-query_cache_limit		= 128K
-query_cache_size		= 64M
-# for more write intensive setups, set to DEMAND or OFF
-#query_cache_type		= DEMAND
-#
-# * Logging and Replication
-#
-# Both location gets rotated by the cronjob.
-# Be aware that this log type is a performance killer.
-# As of 5.1 you can enable the log at runtime!
-#general_log_file        = /var/log/mysql/mysql.log
-#general_log             = 1
-#
-# Error logging goes to syslog due to /etc/mysql/conf.d/mysqld_safe_syslog.cnf.
-#
-# we do want to know about network errors and such
-log_warnings		= 2
-#
-# Enable the slow query log to see queries with especially long duration
-#slow_query_log[={0|1}]
-slow_query_log_file	= /var/log/mysql/mariadb-slow.log
-long_query_time = 10
-#log_slow_rate_limit	= 1000
-log_slow_verbosity	= query_plan
-
-#log-queries-not-using-indexes
-#log_slow_admin_statements
-#
-# The following can be used as easy to replay backup logs or for replication.
-# note: if you are setting up a replication slave, see README.Debian about
-#       other settings you may need to change.
-#server-id		= 1
-#report_host		= master1
-#auto_increment_increment = 2
-#auto_increment_offset	= 1
-log_bin			= /var/log/mysql/mariadb-bin
-log_bin_index		= /var/log/mysql/mariadb-bin.index
-# not fab for performance, but safer
-#sync_binlog		= 1
-expire_logs_days	= 10
-max_binlog_size         = 100M
-# slaves
-#relay_log		= /var/log/mysql/relay-bin
-#relay_log_index	= /var/log/mysql/relay-bin.index
-#relay_log_info_file	= /var/log/mysql/relay-bin.info
-#log_slave_updates
-#read_only
-#
-# If applications support it, this stricter sql_mode prevents some
-# mistakes like inserting invalid dates etc.
-#sql_mode		= NO_ENGINE_SUBSTITUTION,TRADITIONAL
-#
-# * InnoDB
-#
-# InnoDB is enabled by default with a 10MB datafile in /var/lib/mysql/.
-# Read the manual for more InnoDB related options. There are many!
-default_storage_engine	= InnoDB
-innodb_buffer_pool_size	= 256M
-innodb_log_buffer_size	= 8M
-innodb_file_per_table	= 1
-innodb_open_files	= 400
-innodb_io_capacity	= 400
-innodb_flush_method	= O_DIRECT
-#
-# * Security Features
-#
-# Read the manual, too, if you want chroot!
-# chroot = /var/lib/mysql/
-#
-# For generating SSL certificates I recommend the OpenSSL GUI "tinyca".
-#
-# ssl-ca=/etc/mysql/cacert.pem
-# ssl-cert=/etc/mysql/server-cert.pem
-# ssl-key=/etc/mysql/server-key.pem
-
-#
-# * Galera-related settings
-#
-[galera]
-# Mandatory settings
-#wsrep_on=ON
-#wsrep_provider=
-#wsrep_cluster_address=
-#binlog_format=row
-#default_storage_engine=InnoDB
-#innodb_autoinc_lock_mode=2
-#
-# Allow server to accept connections on all interfaces.
-#
-#bind-address=0.0.0.0
-#
-# Optional setting
-#wsrep_slave_threads=1
-#innodb_flush_log_at_trx_commit=0
-
-[mysqldump]
-quick
-quote-names
-max_allowed_packet	= 16M
-
-[mysql]
-#no-auto-rehash	# faster start of mysql but no tab completion
-
-[isamchk]
-key_buffer		= 16M
-
-#
-# * IMPORTANT: Additional settings that can override those from this file!
-#   The files must end with '.cnf', otherwise they'll be ignored.
-#
-!include /etc/mysql/mariadb.cnf
-!includedir /etc/mysql/conf.d/
diff --git a/debian/additions/my.cnf b/debian/additions/my.cnf
new file mode 120000
index 00000000000..d7048c65c43
--- /dev/null
+++ b/debian/additions/my.cnf
@@ -0,0 +1 @@
+mariadb.cnf
\ No newline at end of file
diff --git a/debian/additions/mysqld_safe_syslog.cnf b/debian/additions/mysqld_safe_syslog.cnf
deleted file mode 100644
index 08984c1716b..00000000000
--- a/debian/additions/mysqld_safe_syslog.cnf
+++ /dev/null
@@ -1,3 +0,0 @@
-[mysqld_safe]
-skip_log_error
-syslog
diff --git a/debian/control b/debian/control
index c0132f07dce..71feb204fbd 100644
--- a/debian/control
+++ b/debian/control
@@ -230,16 +230,15 @@ Description: MariaDB database common files (e.g. /etc/mysql/my.cnf)
 
 Package: mariadb-common
 Architecture: all
-Depends: mysql-common,
+Depends: mysql-common (>= 5.6.25),
          ${misc:Depends}
-Description: MariaDB database common files (e.g. /etc/mysql/conf.d/mariadb.cnf)
+Description: MariaDB common configuration files
  MariaDB is a fast, stable and true multi-user, multi-threaded SQL database
  server. SQL (Structured Query Language) is the most popular database query
  language in the world. The main goals of MariaDB are speed, robustness and
  ease of use.
  .
- This package includes files needed by all versions of the client library
- (e.g. /etc/mysql/conf.d/mariadb.cnf).
+ This package includes configuration files common to all MariaDB programs.
 
 Package: mariadb-client-core-10.5
 Architecture: any
diff --git a/debian/mariadb-client-10.5.install b/debian/mariadb-client-10.5.install
index 35b614cd976..b299d3034c9 100644
--- a/debian/mariadb-client-10.5.install
+++ b/debian/mariadb-client-10.5.install
@@ -1,5 +1,8 @@
 debian/additions/innotop/innotop usr/bin/
 debian/additions/mariadb-report usr/bin/
+debian/additions/mariadb.conf.d/50-client.cnf etc/mysql/mariadb.conf.d
+debian/additions/mariadb.conf.d/50-mysql-clients.cnf etc/mysql/mariadb.conf.d
+debian/additions/mariadb.conf.d/60-galera.cnf etc/mysql/mariadb.conf.d
 usr/bin/mariadb-access
 usr/bin/mariadb-admin
 usr/bin/mariadb-conv
diff --git a/debian/mariadb-common.dirs b/debian/mariadb-common.dirs
index 87c71c1c2f5..8aba9560977 100644
--- a/debian/mariadb-common.dirs
+++ b/debian/mariadb-common.dirs
@@ -1 +1 @@
-etc/mysql/mariadb.conf.d/
+etc/mysql/mariadb.conf.d
diff --git a/debian/mariadb-common.postinst b/debian/mariadb-common.postinst
new file mode 100644
index 00000000000..2a8037e8c48
--- /dev/null
+++ b/debian/mariadb-common.postinst
@@ -0,0 +1,29 @@
+#!/bin/sh
+
+set -e
+
+case "$1" in
+  configure)
+    # New packaging paradigm for my.cnf handling among MySQL variants
+    # Used in Ubuntu since Dec-2014 and in Debian since Jul-2015
+    #
+    # If the new mysql-common package does not provide
+    # the update-alternatives facility, notify user about manual fall back
+    if [ -f /usr/share/mysql-common/configure-symlinks ]
+    then
+      /usr/share/mysql-common/configure-symlinks install mariadb "/etc/mysql/mariadb.cnf"
+    else
+      # As configure can be called many times, don't re-create the symlink
+      # if it is there already
+      if [ ! -L /etc/mysql/my.cnf ]
+      then
+        echo "Notice: configure-symlinks trigger could not be called."
+        echo "Please manually create symlinks by running: "
+        echo "  mv -f /etc/mysql/my.cnf /etc/mysql/my.cnf.old"
+        echo "  ln -sf mariadb.cnf /etc/mysql/my.cnf"
+      fi
+    fi
+  ;;
+esac
+
+#DEBHELPER#
diff --git a/debian/mariadb-common.postrm b/debian/mariadb-common.postrm
index 14007fb9149..d0bfa266b7d 100644
--- a/debian/mariadb-common.postrm
+++ b/debian/mariadb-common.postrm
@@ -1,9 +1,16 @@
-#!/bin/bash
+#!/bin/sh
+
 set -e
 
-if [ "$1" = "purge" ]; then
-  rmdir /etc/mysql/conf.d 2>/dev/null || true
-  rmdir /etc/mysql 2>/dev/null || true
-fi
+case "$1" in
+  remove|disappear)
+    # New packaging paradigm for my.cnf handling among MySQL variants
+    # Used in Ubuntu since Dec-2014 and in Debian since Jul-2015
+    if [ -f /usr/share/mysql-common/configure-symlinks ]
+    then
+      /usr/share/mysql-common/configure-symlinks remove mariadb "/etc/mysql/mariadb.cnf"
+    fi
+  ;;
+esac
 
 #DEBHELPER#
diff --git a/debian/mariadb-server-10.5.install b/debian/mariadb-server-10.5.install
index e6c17bd2d10..ca100506753 100644
--- a/debian/mariadb-server-10.5.install
+++ b/debian/mariadb-server-10.5.install
@@ -1,7 +1,8 @@
 debian/additions/debian-start etc/mysql
 debian/additions/debian-start.inc.sh usr/share/mysql
 debian/additions/echo_stderr usr/share/mysql
-debian/additions/mysqld_safe_syslog.cnf etc/mysql/conf.d
+debian/additions/mariadb.conf.d/50-mysqld_safe.cnf etc/mysql/mariadb.conf.d
+debian/additions/mariadb.conf.d/50-server.cnf etc/mysql/mariadb.conf.d
 debian/additions/source_mariadb-10.5.py usr/share/apport/package-hooks
 etc/apparmor.d/usr.sbin.mysqld
 etc/security/user_map.conf