diff --git a/mariadb/Chart.yaml b/mariadb/Chart.yaml
index 7831675..8c3785f 100644
--- a/mariadb/Chart.yaml
+++ b/mariadb/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: mariadb
 description: A Helm chart for MariaDB
 type: application
-version: 0.1.27
+version: 0.1.28
 appVersion: "10.6"
diff --git a/mariadb/templates/mariadb.yaml b/mariadb/templates/mariadb.yaml
index 0db8f45..5b7eb81 100644
--- a/mariadb/templates/mariadb.yaml
+++ b/mariadb/templates/mariadb.yaml
@@ -55,12 +55,15 @@ spec:
       replPasswordSecretKeyRef:
         name: {{ include "mariadb.fullname" . }}-user-password
         key: password-repl
-      {{- if .Values.secondary.replica.recovery.enabled }}
+      {{- if or .Values.secondary.replica.recovery.enabled .Values.secondary.replica.recovery.reconnectOnAuthError }}
       recovery:
-        enabled: true
+        enabled: {{ .Values.secondary.replica.recovery.enabled }}
         {{- if .Values.secondary.replica.recovery.errorDurationThreshold }}
         errorDurationThreshold: {{ .Values.secondary.replica.recovery.errorDurationThreshold }}
         {{- end }}
+        {{- if .Values.secondary.replica.recovery.reconnectOnAuthError }}
+        reconnectOnAuthError: true
+        {{- end }}
       {{- end }}
       {{- if and .Values.backup.enabled (eq .Values.backup.type "physical") }}
       bootstrapFrom:
diff --git a/mariadb/values.yaml b/mariadb/values.yaml
index f7c147a..eac7c66 100644
--- a/mariadb/values.yaml
+++ b/mariadb/values.yaml
@@ -83,6 +83,11 @@ secondary:
     recovery:
       enabled: false
       errorDurationThreshold: 5m
+      # Re-issue CHANGE MASTER when a replica's IO thread is stuck on a repl auth
+      # error (1045) past errorDurationThreshold, re-syncing the repl password from
+      # the secret. Lightweight (no backup rebuild); only acts on an already-broken
+      # replica. Requires the operator's reconnectOnAuthError build (ubc fork).
+      reconnectOnAuthError: true
 
 backup:
   enabled: false