diff --git a/.dockerignore b/.dockerignore
index 568d378..f5b1e13 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,5 +1,6 @@
 *
 !sh/run.sh
+!sh/health.sh
 !sh/clean.sh
 !sh/resolveip.sh
 !sh/my_print_defaults.sh
diff --git a/Dockerfile b/Dockerfile
index 9f86430..bee9f62 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -54,7 +54,7 @@ RUN \
 # my_print_defaults should cover 95% of cases since it doesn't properly do recursion
 COPY sh/resolveip.sh /usr/bin/resolveip
 COPY sh/my_print_defaults.sh /usr/bin/my_print_defaults
-COPY sh/run.sh /run.sh
+COPY sh/run.sh sh/health.sh /
 # Used in run.sh as a default config
 COPY my.cnf /tmp/my.cnf
 
@@ -62,7 +62,7 @@ COPY my.cnf /tmp/my.cnf
 # Since we have no clients, we can't really connect to it and check.
 #
 # Below is in my opinion better than no health check.
-HEALTHCHECK --start-period=5s CMD pgrep mariadbd
+HEALTHCHECK --start-period=5s CMD /health.sh
 
 VOLUME ["/var/lib/mysql"]
 ENTRYPOINT ["/run.sh"]
diff --git a/sh/health.sh b/sh/health.sh
new file mode 100755
index 0000000..75c0e6c
--- /dev/null
+++ b/sh/health.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# shellcheck shell=dash
+set -eo pipefail
+
+CHECK="mariadb"
+
+# prefer root if available
+if [ -n "${MYSQL_ROOT_PASSWORD}" ]; then
+  CHECK="${CHECK} --user=root --password=${MYSQL_ROOT_PASSWORD}"
+else
+  [ -n "${MYSQL_DATABASE}" ] && CHECK="${CHECK} --database=${MYSQL_DATABASE}"
+  [ -n "${MYSQL_USERNAME}" ] && CHECK="${CHECK} --user=${MYSQL_USERNAME}"
+  [ -n "${MYSQL_PASSWORD}" ] && CHECK="${CHECK} --password=${MYSQL_PASSWORD}"
+fi
+CHECK="${CHECK} -e 'select 1;'"
+
+eval ${CHECK}