diff --git a/.github/workflows/registry-ci.yml b/.github/workflows/registry-ci.yml
index 57590a834..5a848c947 100644
--- a/.github/workflows/registry-ci.yml
+++ b/.github/workflows/registry-ci.yml
@@ -14,7 +14,40 @@ jobs:
       fail-fast: false
       matrix:
         php: ["8.3"]
-        db_engine: ["postgres", "mysql", "mariadb"]
+        db:
+          - engine: postgres
+            image: postgres:16-alpine
+            port: 5432
+          - engine: mysql
+            image: mysql:8.0
+            port: 3306
+          - engine: mariadb
+            image: mariadb:11
+            port: 3306
+
+    # Exactly ONE service container per matrix run (the image changes)
+    services:
+      db:
+        image: ${{ matrix.db.image }}
+        ports:
+          - ${{ matrix.db.port }}:${{ matrix.db.port }}
+        env:
+          # Postgres vars (used only by postgres image)
+          POSTGRES_DB: registry_test
+          POSTGRES_USER: test_user
+          POSTGRES_PASSWORD: test_password
+
+          # MySQL vars (used only by mysql image; mariadb image ignores these)
+          MYSQL_DATABASE: registry_test
+          MYSQL_USER: test_user
+          MYSQL_PASSWORD: test_password
+          MYSQL_ROOT_PASSWORD: root_password
+
+          # MariaDB vars (used only by mariadb image)
+          MARIADB_DATABASE: registry_test
+          MARIADB_USER: test_user
+          MARIADB_PASSWORD: test_password
+          MARIADB_ROOT_PASSWORD: root_password
 
     env:
       COMANAGE_REGISTRY_DIR: /srv/comanage-registry
@@ -43,7 +76,7 @@ jobs:
         run: |
           set -euxo pipefail
           sudo apt-get update
-          sudo apt-get upgrade -y
+          sudo apt-get upgade -y
 
       - name: Checkout (only for workflow files)
         shell: bash
@@ -119,6 +152,26 @@ jobs:
           echo "${DOCKER_HOST-}"
           docker context show
 
+      - name: Wait for DB to be ready
+        shell: bash
+        run: |
+          set -euxo pipefail
+          case "${DB_ENGINE}" in
+            postgres)
+              docker exec "${{ job.services.db.id }}" sh -lc 'for i in $(seq 1 60); do pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB" && exit 0; sleep 1; done; exit 1'
+              ;;
+            mysql)
+              docker exec "${{ job.services.db.id }}" sh -lc 'for i in $(seq 1 60); do mysqladmin ping -h 127.0.0.1 -uroot -p"$MYSQL_ROOT_PASSWORD" --silent && exit 0; sleep 1; done; exit 1'
+              ;;
+            mariadb)
+              docker exec "${{ job.services.db.id }}" sh -lc 'for i in $(seq 1 60); do mariadb-admin ping -h 127.0.0.1 -uroot -p"$MARIADB_ROOT_PASSWORD" --silent && exit 0; sleep 1; done; exit 1'
+              ;;
+            *)
+              echo "Unknown DB_ENGINE=${DB_ENGINE}"
+              exit 1
+              ;;
+          esac
+
       - name: Create local/config/database.php placeholder
         shell: bash
         run: |