diff --git a/CPScripts/phpmyadmin_version_changer.sh b/CPScripts/phpmyadmin_version_changer.sh
new file mode 100755
index 000000000..e0050d1d3
--- /dev/null
+++ b/CPScripts/phpmyadmin_version_changer.sh
@@ -0,0 +1,58 @@
+#!/bin/bash
+# Change phpMyAdmin version: download chosen version, preserve config.inc.php and phpmyadminsignin.php.
+# Run as root: bash /usr/local/CyberCP/CPScripts/phpmyadmin_version_changer.sh [VERSION]
+set -e
+PMA_DIR="/usr/local/CyberCP/public/phpmyadmin"
+TMP_CONFIG="/tmp/cyberpanel_pma_config.inc.php.bak"
+TMP_SIGNON="/tmp/cyberpanel_pma_phpmyadminsignin.php.bak"
+LOG="/var/log/cyberpanel_upgrade_debug.log"
+log() { echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] $*" | tee -a "$LOG"; }
+
+if [[ $(id -u) -ne 0 ]]; then
+    echo "Run as root: sudo bash $0 [VERSION]"
+    exit 1
+fi
+
+PMA_VER="${1:-}"
+if [[ -z "$PMA_VER" ]]; then
+    PMA_VER=$(curl -sS "https://api.github.com/repos/phpmyadmin/phpmyadmin/releases/latest" 2>/dev/null | grep -o '"tag_name": "[^"]*' | sed 's/"tag_name": "//;s/^RELEASE_//;s/_/./g' | head -1)
+    [[ -z "$PMA_VER" ]] && PMA_VER="5.2.3"
+fi
+PMA_VER="${PMA_VER// /}"
+[[ "$PMA_VER" =~ ^[0-9]_[0-9]_[0-9]$ ]] && PMA_VER="${PMA_VER//_/.}"
+log "Using phpMyAdmin version: $PMA_VER"
+
+[[ -d "/usr/local/CyberCP/public" ]] || mkdir -p /usr/local/CyberCP/public
+SAVED_CONFIG=false
+SAVED_SIGNON=false
+[[ -f "$PMA_DIR/config.inc.php" ]] && cp -a "$PMA_DIR/config.inc.php" "$TMP_CONFIG" && SAVED_CONFIG=true
+[[ -f "$PMA_DIR/phpmyadminsignin.php" ]] && cp -a "$PMA_DIR/phpmyadminsignin.php" "$TMP_SIGNON" && SAVED_SIGNON=true
+
+TARBALL="/usr/local/CyberCP/public/phpmyadmin.tar.gz"
+URL="https://files.phpmyadmin.net/phpMyAdmin/${PMA_VER}/phpMyAdmin-${PMA_VER}-all-languages.tar.gz"
+wget -q -O "$TARBALL" "$URL" || { log "ERROR: Download failed"; exit 1; }
+[[ $(stat -c%s "$TARBALL" 2>/dev/null) -gt 1000000 ]] || { log "ERROR: Tarball too small"; exit 1; }
+
+rm -rf "$PMA_DIR"
+tar -xzf "$TARBALL" -C /usr/local/CyberCP/public/
+rm -f "$TARBALL"
+EXTRACTED=$(ls -d /usr/local/CyberCP/public/phpMyAdmin-*-all-languages 2>/dev/null | head -1)
+[[ -n "$EXTRACTED" ]] && [[ -d "$EXTRACTED" ]] && mv "$EXTRACTED" "$PMA_DIR" || { log "ERROR: Extract failed"; exit 1; }
+
+if [[ "$SAVED_CONFIG" = true ]] && [[ -f "$TMP_CONFIG" ]]; then
+    cp -a "$TMP_CONFIG" "$PMA_DIR/config.inc.php"
+    rm -f "$TMP_CONFIG"
+fi
+if [[ ! -f "$PMA_DIR/config.inc.php" ]] && [[ -f "$PMA_DIR/config.sample.inc.php" ]]; then
+    cp -a "$PMA_DIR/config.sample.inc.php" "$PMA_DIR/config.inc.php"
+fi
+[[ -f "$PMA_DIR/config.inc.php" ]] && (grep -q "TempDir" "$PMA_DIR/config.inc.php" 2>/dev/null || echo -e "\n\$cfg['TempDir'] = '/usr/local/CyberCP/public/phpmyadmin/tmp';" >> "$PMA_DIR/config.inc.php")
+[[ "$SAVED_SIGNON" = true ]] && [[ -f "$TMP_SIGNON" ]] && cp -a "$TMP_SIGNON" "$PMA_DIR/phpmyadminsignin.php" && rm -f "$TMP_SIGNON"
+[[ "$SAVED_SIGNON" != true ]] && [[ -f /usr/local/CyberCP/plogical/phpmyadminsignin.php ]] && cp -a /usr/local/CyberCP/plogical/phpmyadminsignin.php "$PMA_DIR/phpmyadminsignin.php"
+sed -i "s/'localhost'/'127.0.0.1'/g" "$PMA_DIR/phpmyadminsignin.php" 2>/dev/null || true
+
+mkdir -p "$PMA_DIR/tmp"
+id lscpd &>/dev/null && chown -R lscpd:lscpd "$PMA_DIR"
+chmod -R 755 "$PMA_DIR"
+log "phpMyAdmin changed to version $PMA_VER"
+echo "phpMyAdmin version $PMA_VER installed."
diff --git a/CPScripts/snappymail_version_changer.sh b/CPScripts/snappymail_version_changer.sh
new file mode 100755
index 000000000..e278e9e26
--- /dev/null
+++ b/CPScripts/snappymail_version_changer.sh
@@ -0,0 +1,85 @@
+#!/bin/bash
+# Change SnappyMail version: download chosen version, preserve data dirs, replace app files, fix data path and perms.
+# Run as root: bash /usr/local/CyberCP/CPScripts/snappymail_version_changer.sh [VERSION]
+# Example: bash snappymail_version_changer.sh 2.38.2
+# Data under /usr/local/lscp/cyberpanel/snappymail/data is never removed.
+set -e
+PUBLIC_SNAPPY="/usr/local/CyberCP/public/snappymail"
+DATA_PATH="/usr/local/lscp/cyberpanel/snappymail/data"
+LOG="/var/log/cyberpanel_upgrade_debug.log"
+log() { echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] $*" | tee -a "$LOG"; }
+
+if [[ $(id -u) -ne 0 ]]; then
+    echo "Run as root: sudo bash $0 [VERSION]"
+    exit 1
+fi
+
+# Version: argument or latest from API or default
+SNAPPY_VER="${1:-}"
+if [[ -z "$SNAPPY_VER" ]]; then
+    SNAPPY_VER=$(curl -sS "https://api.github.com/repos/the-djmaze/snappymail/releases/latest" 2>/dev/null | grep -o '"tag_name": "v[^"]*' | sed 's/"tag_name": "v//' | head -1)
+    [[ -z "$SNAPPY_VER" ]] && SNAPPY_VER="2.38.2"
+    log "Using SnappyMail version: $SNAPPY_VER (from API or default)"
+else
+    SNAPPY_VER="${SNAPPY_VER// /}"
+    log "Using SnappyMail version: $SNAPPY_VER (from argument)"
+fi
+
+[[ -d "/usr/local/CyberCP/public" ]] || mkdir -p /usr/local/CyberCP/public
+cd /usr/local/CyberCP/public || exit 1
+
+# Download zip (data dirs are NOT under public/snappymail; we only replace app tree)
+ZIP="snappymail-${SNAPPY_VER}.zip"
+URL="https://github.com/the-djmaze/snappymail/releases/download/v${SNAPPY_VER}/${ZIP}"
+log "Downloading $URL ..."
+if ! wget -q -O "$ZIP" "$URL"; then
+    log "ERROR: Download failed. Check version at https://github.com/the-djmaze/snappymail/releases"
+    exit 1
+fi
+
+# Replace only app tree; do not remove DATA_PATH or public/snappymail/data if it exists
+if [[ -d "$PUBLIC_SNAPPY" ]]; then
+    rm -rf "$PUBLIC_SNAPPY"
+    log "Removed existing public/snappymail app tree (data preserved under $DATA_PATH)"
+fi
+unzip -q "$ZIP" -d "$PUBLIC_SNAPPY"
+rm -f "$ZIP"
+
+# Fix data path in include.php
+INCLUDE_PHP=""
+for inc in "$PUBLIC_SNAPPY"/snappymail/v/*/include.php; do
+    [[ -f "$inc" ]] && INCLUDE_PHP="$inc" && break
+done
+if [[ -n "$INCLUDE_PHP" ]] && [[ -f "$INCLUDE_PHP" ]]; then
+    if grep -q "\$sCustomDataPath = ''" "$INCLUDE_PHP" 2>/dev/null; then
+        sed -i "s|\$sCustomDataPath = '';|\$sCustomDataPath = '/usr/local/lscp/cyberpanel/snappymail/data';|" "$INCLUDE_PHP"
+        log "Set data path in include.php"
+    fi
+fi
+
+# Ensure data dirs exist
+mkdir -p "$DATA_PATH/_data_/_default_/configs"
+mkdir -p "$DATA_PATH/_data_/_default_/domains"
+mkdir -p "$DATA_PATH/_data_/_default_/storage"
+mkdir -p "$DATA_PATH/_data_/_default_/temp"
+mkdir -p "$DATA_PATH/_data_/_default_/cache"
+
+# Permissions
+find "$PUBLIC_SNAPPY" -type d -exec chmod 755 {} \;
+find "$PUBLIC_SNAPPY" -type f -exec chmod 644 {} \;
+if id lscpd &>/dev/null; then
+    chown -R lscpd:lscpd "$PUBLIC_SNAPPY"
+    chown -R lscpd:lscpd "$DATA_PATH"
+    log "Set ownership lscpd:lscpd"
+fi
+chmod -R 775 "$DATA_PATH" 2>/dev/null || true
+
+# Optional: run CyberPanel SnappyMail integration if present
+if [[ -f /usr/local/CyberCP/snappymail_cyberpanel.php ]]; then
+    for php in /usr/local/lsws/lsphp83/bin/php /usr/local/lsws/lsphp82/bin/php /usr/local/lsws/lsphp81/bin/php /usr/local/lsws/lsphp80/bin/php; do
+        [[ -x "$php" ]] && $php /usr/local/CyberCP/snappymail_cyberpanel.php 2>/dev/null && break
+    done
+fi
+
+log "SnappyMail changed to version $SNAPPY_VER"
+echo "SnappyMail version changed to $SNAPPY_VER. Data preserved under $DATA_PATH"
diff --git a/cyberpanel_install_monolithic.sh b/cyberpanel_install_monolithic.sh
index 62e76e8a6..00dca75eb 100644
--- a/cyberpanel_install_monolithic.sh
+++ b/cyberpanel_install_monolithic.sh
@@ -625,11 +625,14 @@ install_cyberpanel_direct() {
     # Ask MariaDB version (after web server choice) if not set via --mariadb-version
     if [ -z "$MARIADB_VER" ]; then
         echo ""
-        echo "  MariaDB version: 10.11, 11.8 (LTS, default) or 12.1?"
-        read -r -t 60 -p "  Enter 10.11, 11.8 or 12.1 [11.8]: " MARIADB_VER || true
+        echo "  MariaDB version: 10.11, 11.8 (LTS, default), 12.1, 12.2, 12.3 or other X.Y?"
+        read -r -t 60 -p "  Enter version [11.8]: " MARIADB_VER || true
         MARIADB_VER="${MARIADB_VER:-11.8}"
         MARIADB_VER="${MARIADB_VER// /}"
-        if [ "$MARIADB_VER" != "10.11" ] && [ "$MARIADB_VER" != "11.8" ] && [ "$MARIADB_VER" != "12.1" ]; then
+        # Normalize to major.minor (e.g. 12.3.1 -> 12.3)
+        if [[ "$MARIADB_VER" =~ ^([0-9]+)\.([0-9]+) ]]; then
+            MARIADB_VER="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}"
+        else
             MARIADB_VER="11.8"
         fi
         echo "  Using MariaDB $MARIADB_VER"
diff --git a/cyberpanel_upgrade_monolithic.sh b/cyberpanel_upgrade_monolithic.sh
index a7a4a51fd..e5fbb8a26 100644
--- a/cyberpanel_upgrade_monolithic.sh
+++ b/cyberpanel_upgrade_monolithic.sh
@@ -792,7 +792,8 @@ EOF
       sed -i 's|https://yum.mariadb.org/RPM-GPG-KEY-MariaDB|https://cyberpanel.sh/yum.mariadb.org/RPM-GPG-KEY-MariaDB|g' /etc/yum.repos.d/MariaDB.repo
     fi
     dnf clean metadata --disablerepo='*' --enablerepo=mariadb 2>/dev/null || true
-    # MariaDB 10 -> 11 or 11 -> 12: RPM scriptlet blocks in-place upgrade; do manual stop, remove old server, install target, start, mariadb-upgrade
+    # MariaDB 10 -> 11 or 11 -> 12: RPM scriptlet blocks in-place upgrade; do manual stop, remove old server, install target, start, mariadb-upgrade.
+    # Data in /var/lib/mysql is preserved; no databases are dropped.
     MARIADB_OLD_10=$(rpm -qa 'MariaDB-server-10*' 2>/dev/null | head -1)
     [[ -z "$MARIADB_OLD_10" ]] && MARIADB_OLD_10=$(rpm -qa 2>/dev/null | grep -E '^MariaDB-server-10\.' | head -1)
     MARIADB_OLD_11=$(rpm -qa 'MariaDB-server-11*' 2>/dev/null | head -1)
@@ -811,7 +812,7 @@ EOF
       printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
       systemctl start mariadb 2>/dev/null || true
       sleep 2
-      mariadb-upgrade -u root 2>/dev/null || true
+      mariadb-upgrade --force -u root 2>/dev/null || true
       echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] MariaDB manual upgrade to $MARIADB_VER_REPO completed." | tee -a /var/log/cyberpanel_upgrade_debug.log
     elif [[ -n "$MARIADB_OLD_11" ]] && [[ "$MARIADB_VER_REPO" =~ ^12\. ]]; then
       echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] MariaDB 11.x detected; performing manual upgrade to $MARIADB_VER_REPO (stop, remove, install, start, mariadb-upgrade)..." | tee -a /var/log/cyberpanel_upgrade_debug.log
@@ -825,7 +826,7 @@ EOF
       printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
       systemctl start mariadb 2>/dev/null || true
       sleep 2
-      mariadb-upgrade -u root 2>/dev/null || true
+      mariadb-upgrade --force -u root 2>/dev/null || true
       echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] MariaDB manual upgrade to $MARIADB_VER_REPO completed (11->12)." | tee -a /var/log/cyberpanel_upgrade_debug.log
     else
       # Normal install/upgrade (same version or 10.11)
@@ -848,7 +849,7 @@ EOF
           printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
           systemctl start mariadb 2>/dev/null || true
           sleep 2
-          mariadb-upgrade -u root 2>/dev/null || true
+          mariadb-upgrade --force -u root 2>/dev/null || true
           echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] MariaDB manual 11->12 fallback completed." | tee -a /var/log/cyberpanel_upgrade_debug.log
         fi
       fi
@@ -899,7 +900,7 @@ EOF
       printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
       systemctl start mariadb 2>/dev/null || true
       sleep 2
-      mariadb-upgrade -u root 2>/dev/null || true
+      mariadb-upgrade --force -u root 2>/dev/null || true
       echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] MariaDB manual upgrade to $MARIADB_VER_REPO completed (AlmaLinux 9)." | tee -a /var/log/cyberpanel_upgrade_debug.log
     elif [[ -n "$MARIADB_OLD_11_AL9" ]] && [[ "$MARIADB_VER_REPO" =~ ^12\. ]]; then
       echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] MariaDB 11.x detected (AlmaLinux 9); manual upgrade to $MARIADB_VER_REPO..." | tee -a /var/log/cyberpanel_upgrade_debug.log
@@ -913,7 +914,7 @@ EOF
       printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
       systemctl start mariadb 2>/dev/null || true
       sleep 2
-      mariadb-upgrade -u root 2>/dev/null || true
+      mariadb-upgrade --force -u root 2>/dev/null || true
       echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] MariaDB manual upgrade to $MARIADB_VER_REPO completed (AlmaLinux 9, 11->12)." | tee -a /var/log/cyberpanel_upgrade_debug.log
     else
       dnf install -y --enablerepo=mariadb MariaDB-server MariaDB-devel 2>/dev/null || dnf install -y mariadb-server mariadb-devel
diff --git a/install/install.py b/install/install.py
index d53cf892a..f4d7b2bce 100644
--- a/install/install.py
+++ b/install/install.py
@@ -55,6 +55,24 @@ FetchCloudLinuxAlmaVersionVersion = install_utils.FetchCloudLinuxAlmaVersionVers
 get_distro = install_utils.get_distro
 
 
+def _normalize_mariadb_version(ver):
+    """Accept 10.3-10.11, 11.0-11.8, 12.0-12.x; return major.minor for repo or 11.8 if invalid."""
+    if not ver or not isinstance(ver, str):
+        return '11.8'
+    v = ver.strip()
+    m = re.match(r'^(\d+)\.(\d+)(?:\.\d+)*$', v)
+    if not m:
+        return '11.8'
+    major, minor = int(m.group(1)), int(m.group(2))
+    if major == 10 and 3 <= minor <= 11:
+        return '10.%d' % minor
+    if major == 11 and 0 <= minor <= 8:
+        return '11.%d' % minor
+    if major == 12 and 0 <= minor <= 99:
+        return '12.%d' % minor
+    return '11.8'
+
+
 def get_Ubuntu_release():
     release = install_utils.get_Ubuntu_release(use_print=False, exit_on_error=True)
     if release == -1:
@@ -1871,7 +1889,7 @@ module cyberpanel_ols {
                         except (ValueError, TypeError):
                             pass
                 
-                # Set up MariaDB repository only if not already installed (version from --mariadb-version: 10.11, 11.8 or 12.1)
+                # Set up MariaDB repository only if not already installed (version from --mariadb-version: 10.3-10.11, 11.0-11.8, 12.0-12.x)
                 mariadb_ver = getattr(preFlightsChecks, 'mariadb_version', '11.8')
                 command = f'curl -LsS https://downloads.mariadb.com/MariaDB/mariadb_repo_setup | bash -s -- --mariadb-server-version={mariadb_ver}'
                 self.call(command, self.distro, command, command, 1, 1, os.EX_OSERR, True)
@@ -1904,9 +1922,14 @@ module cyberpanel_ols {
                             shell=True, timeout=5, capture_output=True
                         )
                         self.stdOut("Temporarily removed MariaDB-server from dnf exclude for installation (fallback)", 1)
-                # Install from official MariaDB repo (capitalized package names); --nobest for 10.11/11.8 on el9
+                # Install from official MariaDB repo (capitalized package names); --nobest for 10.x and 11.0-11.8 on el9
                 mariadb_packages = 'MariaDB-server MariaDB-client MariaDB-backup MariaDB-devel'
-                if mariadb_ver in ('10.11', '11.8'):
+                try:
+                    maj_min = tuple(int(x) for x in mariadb_ver.split('.')[:2])
+                    use_nobest = (maj_min[0] == 10) or (maj_min[0] == 11 and maj_min[1] <= 8)
+                except (ValueError, IndexError):
+                    use_nobest = True
+                if use_nobest:
                     command = f'dnf install -y --nobest {mariadb_packages}'
                 else:
                     command = f'dnf install -y {mariadb_packages}'
@@ -3824,18 +3847,23 @@ class Migration(migrations.Migration):
             except Exception:
                 pass
 
-            # Resolve phpMyAdmin version (same as upgrade path)
-            phpmyadmin_version = '5.2.3'
-            try:
-                from plogical.versionFetcher import get_latest_phpmyadmin_version
-                latest_version = get_latest_phpmyadmin_version()
-                if latest_version and latest_version != phpmyadmin_version:
-                    self.stdOut(f"Using latest phpMyAdmin version: {latest_version}", 1)
-                    phpmyadmin_version = latest_version
-                else:
-                    self.stdOut(f"Using fallback phpMyAdmin version: {phpmyadmin_version}", 1)
-            except Exception as e:
-                self.stdOut(f"Failed to fetch latest phpMyAdmin version, using fallback: {e}", 1)
+            # Resolve phpMyAdmin version: CLI override (--phpmyadmin-version), else latest from API, else fallback
+            phpmyadmin_version = getattr(preFlightsChecks, 'phpmyadmin_version', None) or ''
+            phpmyadmin_version = (phpmyadmin_version or '').strip()
+            if not phpmyadmin_version or not re.match(r'^\d+\.\d+\.\d+$', phpmyadmin_version):
+                phpmyadmin_version = '5.2.3'
+                try:
+                    from plogical.versionFetcher import get_latest_phpmyadmin_version
+                    latest_version = get_latest_phpmyadmin_version()
+                    if latest_version and re.match(r'^\d+\.\d+\.\d+$', latest_version):
+                        self.stdOut(f"Using latest phpMyAdmin version: {latest_version}", 1)
+                        phpmyadmin_version = latest_version
+                    else:
+                        self.stdOut(f"Using fallback phpMyAdmin version: {phpmyadmin_version}", 1)
+                except Exception as e:
+                    self.stdOut(f"Failed to fetch latest phpMyAdmin version, using fallback: {e}", 1)
+            else:
+                self.stdOut(f"Using phpMyAdmin version: {phpmyadmin_version}", 1)
 
             self.stdOut("Installing phpMyAdmin...", 1)
             tarball = '/usr/local/CyberCP/public/phpmyadmin.tar.gz'
@@ -4544,27 +4572,40 @@ user_query = SELECT email as user, password, 'vmail' as uid, 'vmail' as gid, '/h
 
     def downoad_and_install_raindloop(self):
         try:
-            #######
-
             if not os.path.exists("/usr/local/CyberCP/public"):
                 os.mkdir("/usr/local/CyberCP/public")
 
             if os.path.exists("/usr/local/CyberCP/public/snappymail"):
                 return 0
 
+            # Version: CLI override (--snappymail-version), then latest from API, else class default
+            snappy_ver = getattr(preFlightsChecks, 'snappymail_version', None) or ''
+            snappy_ver = (snappy_ver or '').strip()
+            if not snappy_ver or not re.match(r'^\d+\.\d+(\.\d+)?$', snappy_ver):
+                try:
+                    from plogical.versionFetcher import get_latest_snappymail_version
+                    latest = get_latest_snappymail_version()
+                    if latest and re.match(r'^\d+\.\d+', latest):
+                        snappy_ver = latest
+                    else:
+                        snappy_ver = preFlightsChecks.SnappyVersion
+                except Exception:
+                    snappy_ver = preFlightsChecks.SnappyVersion
+            self.stdOut("Using SnappyMail version: %s" % snappy_ver, 1)
+
             os.chdir("/usr/local/CyberCP/public")
 
-            command = 'wget https://github.com/the-djmaze/snappymail/releases/download/v%s/snappymail-%s.zip' % (preFlightsChecks.SnappyVersion, preFlightsChecks.SnappyVersion)
+            command = 'wget https://github.com/the-djmaze/snappymail/releases/download/v%s/snappymail-%s.zip' % (snappy_ver, snappy_ver)
 
             preFlightsChecks.call(command, self.distro, command, command, 1, 1, os.EX_OSERR)
 
             #############
 
-            command = 'unzip snappymail-%s.zip -d /usr/local/CyberCP/public/snappymail' % (preFlightsChecks.SnappyVersion)
+            command = 'unzip snappymail-%s.zip -d /usr/local/CyberCP/public/snappymail' % (snappy_ver,)
             preFlightsChecks.call(command, self.distro, command, command, 1, 1, os.EX_OSERR)
 
             try:
-                os.remove("snappymail-%s.zip" % (preFlightsChecks.SnappyVersion))
+                os.remove("snappymail-%s.zip" % (snappy_ver,))
             except:
                 pass
 
@@ -6616,14 +6657,19 @@ def main():
     parser.add_argument('--mysqluser', help='MySQL user if remote is chosen.')
     parser.add_argument('--mysqlpassword', help='MySQL password if remote is chosen.')
     parser.add_argument('--mysqlport', help='MySQL port if remote is chosen.')
-    parser.add_argument('--mariadb-version', default='11.8', help='MariaDB version: 10.11, 11.8 (LTS, default) or 12.1')
+    parser.add_argument('--mariadb-version', default='11.8', help='MariaDB version: 10.3-10.11, 11.0-11.8, 12.0-12.x (default 11.8)')
+    parser.add_argument('--phpmyadmin-version', default='', help='phpMyAdmin version (e.g. 5.2.3); empty = latest from API')
+    parser.add_argument('--snappymail-version', default='', help='SnappyMail version (e.g. 2.38.2); empty = latest from API')
 
     args = parser.parse_args()
     # Normalize and validate MariaDB version choice (default 11.8)
-    mariadb_ver = (getattr(args, 'mariadb_version', None) or '11.8').strip()
-    if mariadb_ver not in ('10.11', '11.8', '12.1'):
-        mariadb_ver = '11.8'
+    mariadb_ver = _normalize_mariadb_version(getattr(args, 'mariadb_version', None) or '11.8')
     preFlightsChecks.mariadb_version = mariadb_ver
+    # Optional phpMyAdmin/SnappyMail version overrides (empty = use latest from API)
+    if getattr(args, 'phpmyadmin_version', ''):
+        preFlightsChecks.phpmyadmin_version = (args.phpmyadmin_version or '').strip()
+    if getattr(args, 'snappymail_version', ''):
+        preFlightsChecks.snappymail_version = (args.snappymail_version or '').strip()
 
     logging.InstallLog.ServerIP = args.publicip
     logging.InstallLog.writeToFile("Starting CyberPanel installation..,10")
diff --git a/install/venvsetup_modules/03_main_run_pip.sh b/install/venvsetup_modules/03_main_run_pip.sh
index 9e2716f8c..bfd89c509 100644
--- a/install/venvsetup_modules/03_main_run_pip.sh
+++ b/install/venvsetup_modules/03_main_run_pip.sh
@@ -8,10 +8,13 @@ if [[ $debug == "0" ]] ; then
 fi
 
 if [[ $debug == "1" ]] ; then
+	EXTRA_VER_ARGS=""
+	[[ -n "${PHPMYADMIN_VER:-}" ]] && EXTRA_VER_ARGS="$EXTRA_VER_ARGS --phpmyadmin-version ${PHPMYADMIN_VER}"
+	[[ -n "${SNAPPYMAIL_VER:-}" ]] && EXTRA_VER_ARGS="$EXTRA_VER_ARGS --snappymail-version ${SNAPPYMAIL_VER}"
 	if [[ $DEV == "ON" ]] ; then
-	/usr/local/CyberPanel/bin/python install.py $SERVER_IP $SERIAL_NO $LICENSE_KEY --mariadb-version "${MARIADB_VER:-11.8}"
+	/usr/local/CyberPanel/bin/python install.py $SERVER_IP $SERIAL_NO $LICENSE_KEY --mariadb-version "${MARIADB_VER:-11.8}" $EXTRA_VER_ARGS
 	else
-	/usr/local/CyberPanel/bin/python2 install.py $SERVER_IP $SERIAL_NO $LICENSE_KEY --mariadb-version "${MARIADB_VER:-11.8}"
+	/usr/local/CyberPanel/bin/python2 install.py $SERVER_IP $SERIAL_NO $LICENSE_KEY --mariadb-version "${MARIADB_VER:-11.8}" $EXTRA_VER_ARGS
 	fi
 	
 	if grep "CyberPanel installation successfully completed" /var/log/installLogs.txt > /dev/null; then 
diff --git a/install/venvsetup_monolithic.sh b/install/venvsetup_monolithic.sh
index 80432a4c5..8dbf7f4d0 100644
--- a/install/venvsetup_monolithic.sh
+++ b/install/venvsetup_monolithic.sh
@@ -925,9 +925,12 @@ fi
 
 if [[ $debug == "1" ]] ; then
 	if [[ $DEV == "ON" ]] ; then
-	/usr/local/CyberPanel/bin/python install.py $SERVER_IP $SERIAL_NO $LICENSE_KEY --mariadb-version "${MARIADB_VER:-11.8}"
+	EXTRA_VER_ARGS=""
+	[[ -n "${PHPMYADMIN_VER:-}" ]] && EXTRA_VER_ARGS="$EXTRA_VER_ARGS --phpmyadmin-version ${PHPMYADMIN_VER}"
+	[[ -n "${SNAPPYMAIL_VER:-}" ]] && EXTRA_VER_ARGS="$EXTRA_VER_ARGS --snappymail-version ${SNAPPYMAIL_VER}"
+	/usr/local/CyberPanel/bin/python install.py $SERVER_IP $SERIAL_NO $LICENSE_KEY --mariadb-version "${MARIADB_VER:-11.8}" $EXTRA_VER_ARGS
 	else
-	/usr/local/CyberPanel/bin/python2 install.py $SERVER_IP $SERIAL_NO $LICENSE_KEY --mariadb-version "${MARIADB_VER:-11.8}"
+	/usr/local/CyberPanel/bin/python2 install.py $SERVER_IP $SERIAL_NO $LICENSE_KEY --mariadb-version "${MARIADB_VER:-11.8}" $EXTRA_VER_ARGS
 	fi
 	
 	if grep "CyberPanel installation successfully completed" /var/log/installLogs.txt > /dev/null; then 
diff --git a/install_modules/02_install_core.sh b/install_modules/02_install_core.sh
index facc24d89..dae666374 100644
--- a/install_modules/02_install_core.sh
+++ b/install_modules/02_install_core.sh
@@ -87,11 +87,14 @@ install_cyberpanel_direct() {
     # Ask MariaDB version (after web server choice) if not set via --mariadb-version
     if [ -z "$MARIADB_VER" ]; then
         echo ""
-        echo "  MariaDB version: 10.11, 11.8 (LTS, default) or 12.1?"
-        read -r -t 60 -p "  Enter 10.11, 11.8 or 12.1 [11.8]: " MARIADB_VER || true
+        echo "  MariaDB version: 10.11, 11.8 (LTS, default), 12.1, 12.2, 12.3 or other X.Y?"
+        read -r -t 60 -p "  Enter version [11.8]: " MARIADB_VER || true
         MARIADB_VER="${MARIADB_VER:-11.8}"
         MARIADB_VER="${MARIADB_VER// /}"
-        if [ "$MARIADB_VER" != "10.11" ] && [ "$MARIADB_VER" != "11.8" ] && [ "$MARIADB_VER" != "12.1" ]; then
+        # Normalize to major.minor (e.g. 12.3.1 -> 12.3)
+        if [[ "$MARIADB_VER" =~ ^([0-9]+)\.([0-9]+) ]]; then
+            MARIADB_VER="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}"
+        else
             MARIADB_VER="11.8"
         fi
         echo "  Using MariaDB $MARIADB_VER"
diff --git a/plogical/upgrade.py b/plogical/upgrade.py
index fc37c3dea..0cfbc58f1 100644
--- a/plogical/upgrade.py
+++ b/plogical/upgrade.py
@@ -1194,27 +1194,58 @@ module cyberpanel_ols {
     def download_install_phpmyadmin():
         try:
             cwd = os.getcwd()
+            pma_dir = '/usr/local/CyberCP/public/phpmyadmin'
+            tmp_config = '/tmp/cyberpanel_pma_config.inc.php'
+            tmp_signon = '/tmp/cyberpanel_pma_phpmyadminsignin.php'
 
             if not os.path.exists("/usr/local/CyberCP/public"):
                 os.mkdir("/usr/local/CyberCP/public")
 
+            # Preserve existing config and signon before removing phpmyadmin (for up/downgrade)
+            saved_config = False
+            saved_signon = False
+            if os.path.isdir(pma_dir):
+                if os.path.isfile(os.path.join(pma_dir, 'config.inc.php')):
+                    try:
+                        shutil.copy2(os.path.join(pma_dir, 'config.inc.php'), tmp_config)
+                        saved_config = True
+                    except Exception:
+                        pass
+                if os.path.isfile(os.path.join(pma_dir, 'phpmyadminsignin.php')):
+                    try:
+                        shutil.copy2(os.path.join(pma_dir, 'phpmyadminsignin.php'), tmp_signon)
+                        saved_signon = True
+                    except Exception:
+                        pass
+
             try:
-                shutil.rmtree("/usr/local/CyberCP/public/phpmyadmin")
-            except:
+                shutil.rmtree(pma_dir)
+            except Exception:
                 pass
 
-            # Try to fetch latest phpMyAdmin version from GitHub
-            phpmyadmin_version = '5.2.3'  # Fallback version
-            try:
-                from plogical.versionFetcher import get_latest_phpmyadmin_version
-                latest_version = get_latest_phpmyadmin_version()
-                if latest_version and latest_version != phpmyadmin_version:
-                    Upgrade.stdOut(f"Using latest phpMyAdmin version: {latest_version}", 0)
-                    phpmyadmin_version = latest_version
-                else:
-                    Upgrade.stdOut(f"Using fallback phpMyAdmin version: {phpmyadmin_version}", 0)
-            except Exception as e:
-                Upgrade.stdOut(f"Failed to fetch latest phpMyAdmin version, using fallback: {e}", 0)
+            # Version: /etc/cyberpanel/phpmyadmin_version, then latest from API, then fallback
+            phpmyadmin_version = '5.2.3'
+            version_file = '/etc/cyberpanel/phpmyadmin_version'
+            if os.path.isfile(version_file):
+                try:
+                    with open(version_file, 'r') as f:
+                        raw = (f.read() or '').strip()
+                    if raw and len(raw) < 20 and all(c.isdigit() or c == '.' for c in raw):
+                        phpmyadmin_version = raw
+                        Upgrade.stdOut(f"Using phpMyAdmin version from {version_file}: {phpmyadmin_version}", 0)
+                except Exception:
+                    pass
+            if phpmyadmin_version == '5.2.3':
+                try:
+                    from plogical.versionFetcher import get_latest_phpmyadmin_version
+                    latest_version = get_latest_phpmyadmin_version()
+                    if latest_version and latest_version != phpmyadmin_version:
+                        Upgrade.stdOut(f"Using latest phpMyAdmin version: {latest_version}", 0)
+                        phpmyadmin_version = latest_version
+                    else:
+                        Upgrade.stdOut(f"Using fallback phpMyAdmin version: {phpmyadmin_version}", 0)
+                except Exception as e:
+                    Upgrade.stdOut(f"Failed to fetch latest phpMyAdmin version, using fallback: {e}", 0)
 
             Upgrade.stdOut("Installing phpMyAdmin...", 0)
 
@@ -1227,36 +1258,46 @@ module cyberpanel_ols {
             command = 'tar -xzf /usr/local/CyberCP/public/phpmyadmin.tar.gz -C /usr/local/CyberCP/public/'
             Upgrade.executioner_silent(command, 'Extract phpMyAdmin')
 
-            # Move extracted dir to phpmyadmin (support phpMyAdmin-X.Y.Z-all-languages or similar)
             import glob
             extracted = glob.glob('/usr/local/CyberCP/public/phpMyAdmin-*-all-languages')
             if not extracted:
                 extracted = glob.glob('/usr/local/CyberCP/public/phpMyAdmin-*')
             if extracted:
-                if os.path.exists('/usr/local/CyberCP/public/phpmyadmin'):
-                    shutil.rmtree('/usr/local/CyberCP/public/phpmyadmin')
-                os.rename(extracted[0], '/usr/local/CyberCP/public/phpmyadmin')
+                if os.path.exists(pma_dir):
+                    shutil.rmtree(pma_dir)
+                os.rename(extracted[0], pma_dir)
             else:
                 Upgrade.executioner('mv /usr/local/CyberCP/public/phpMyAdmin-*-all-languages /usr/local/CyberCP/public/phpmyadmin', 0)
 
             command = 'rm -f /usr/local/CyberCP/public/phpmyadmin.tar.gz'
             Upgrade.executioner_silent(command, 'Cleanup phpMyAdmin tar.gz')
 
-            if not os.path.isdir('/usr/local/CyberCP/public/phpmyadmin'):
+            if not os.path.isdir(pma_dir):
                 raise RuntimeError('phpMyAdmin directory was not created after extract/mv')
             Upgrade.stdOut("phpMyAdmin installation completed.", 0)
 
-            ## Write secret phrase
-
-            rString = ''.join([random.choice(string.ascii_letters + string.digits) for n in range(32)])
-
-            data = open('/usr/local/CyberCP/public/phpmyadmin/config.sample.inc.php', 'r').readlines()
-
-            writeToFile = open('/usr/local/CyberCP/public/phpmyadmin/config.inc.php', 'w')
-
-            writeE = 1
-
-            phpMyAdminContent = """
+            # Restore preserved config/signon and apply minimal overrides, or create new config
+            if saved_config and os.path.isfile(tmp_config):
+                shutil.copy2(tmp_config, os.path.join(pma_dir, 'config.inc.php'))
+                try:
+                    os.remove(tmp_config)
+                except Exception:
+                    pass
+                # Ensure TempDir and host/port present (append if missing)
+                with open(os.path.join(pma_dir, 'config.inc.php'), 'r') as f:
+                    cfg_content = f.read()
+                if "TempDir" not in cfg_content:
+                    with open(os.path.join(pma_dir, 'config.inc.php'), 'a') as f:
+                        f.write("\n$cfg['TempDir'] = '/usr/local/CyberCP/public/phpmyadmin/tmp';\n")
+                if "'host'" not in cfg_content and 'host' not in cfg_content:
+                    with open(os.path.join(pma_dir, 'config.inc.php'), 'a') as f:
+                        f.write("$cfg['Servers'][$i]['host'] = '127.0.0.1';\n$cfg['Servers'][$i]['port'] = '3306';\n")
+            else:
+                rString = ''.join([random.choice(string.ascii_letters + string.digits) for n in range(32)])
+                data = open(os.path.join(pma_dir, 'config.sample.inc.php'), 'r').readlines()
+                writeToFile = open(os.path.join(pma_dir, 'config.inc.php'), 'w')
+                writeE = 1
+                phpMyAdminContent = """
 $cfg['Servers'][$i]['AllowNoPassword'] = false;
 $cfg['Servers'][$i]['auth_type'] = 'signon';
 $cfg['Servers'][$i]['SignonSession'] = 'SignonSession';
@@ -1265,48 +1306,44 @@ $cfg['Servers'][$i]['LogoutURL'] = 'phpmyadminsignin.php?logout';
 $cfg['Servers'][$i]['host'] = '127.0.0.1';
 $cfg['Servers'][$i]['port'] = '3306';
 """
-
-            for items in data:
-                if items.find('blowfish_secret') > -1:
-                    writeToFile.writelines(
-                        "$cfg['blowfish_secret'] = '" + rString + "'; /* YOU MUST FILL IN THIS FOR COOKIE AUTH! */\n")
-                elif items.find('/* Authentication type */') > -1:
-                    writeToFile.writelines(items)
-                    writeToFile.write(phpMyAdminContent)
-                    writeE = 0
-                elif items.find("$cfg['Servers'][$i]['AllowNoPassword']") > -1:
-                    writeE = 1
-                else:
-                    if writeE:
+                for items in data:
+                    if items.find('blowfish_secret') > -1:
+                        writeToFile.writelines(
+                            "$cfg['blowfish_secret'] = '" + rString + "'; /* YOU MUST FILL IN THIS FOR COOKIE AUTH! */\n")
+                    elif items.find('/* Authentication type */') > -1:
                         writeToFile.writelines(items)
-
-            writeToFile.writelines("$cfg['TempDir'] = '/usr/local/CyberCP/public/phpmyadmin/tmp';\n")
-
-            writeToFile.close()
+                        writeToFile.write(phpMyAdminContent)
+                        writeE = 0
+                    elif items.find("$cfg['Servers'][$i]['AllowNoPassword']") > -1:
+                        writeE = 1
+                    else:
+                        if writeE:
+                            writeToFile.writelines(items)
+                writeToFile.writelines("$cfg['TempDir'] = '/usr/local/CyberCP/public/phpmyadmin/tmp';\n")
+                writeToFile.close()
 
             os.mkdir('/usr/local/CyberCP/public/phpmyadmin/tmp')
 
-            command = 'cp /usr/local/CyberCP/plogical/phpmyadminsignin.php /usr/local/CyberCP/public/phpmyadmin/phpmyadminsignin.php'
-            Upgrade.executioner(command, 0)
+            if saved_signon and os.path.isfile(tmp_signon):
+                shutil.copy2(tmp_signon, os.path.join(pma_dir, 'phpmyadminsignin.php'))
+                try:
+                    os.remove(tmp_signon)
+                except Exception:
+                    pass
+            else:
+                command = 'cp /usr/local/CyberCP/plogical/phpmyadminsignin.php /usr/local/CyberCP/public/phpmyadmin/phpmyadminsignin.php'
+                Upgrade.executioner(command, 0)
 
             passFile = "/etc/cyberpanel/mysqlPassword"
-
             try:
                 import json
                 jsonData = json.loads(open(passFile, 'r').read())
-
-                mysqluser = jsonData['mysqluser']
-                mysqlpassword = jsonData['mysqlpassword']
-                mysqlport = jsonData.get('mysqlport', 3306)
                 mysqlhost = jsonData.get('mysqlhost', '127.0.0.1') or '127.0.0.1'
                 if mysqlhost == 'localhost':
                     mysqlhost = '127.0.0.1'
-
-                command = "sed -i 's|localhost|%s|g' /usr/local/CyberCP/public/phpmyadmin/phpmyadminsignin.php" % (
-                    mysqlhost)
+                command = "sed -i 's|localhost|%s|g' /usr/local/CyberCP/public/phpmyadmin/phpmyadminsignin.php" % (mysqlhost)
                 Upgrade.executioner(command, 0)
-
-            except:
+            except Exception:
                 pass
 
             command = 'chown -R lscpd:lscpd /usr/local/CyberCP/public/phpmyadmin'
@@ -1346,52 +1383,36 @@ $cfg['Servers'][$i]['port'] = '3306';
     @staticmethod
     def downoad_and_install_raindloop():
         try:
-            #######
-
-            # if os.path.exists("/usr/local/CyberCP/public/rainloop"):
-            #
-            #     if os.path.exists("/usr/local/lscp/cyberpanel/rainloop/data"):
-            #         pass
-            #     else:
-            #         command = "mv /usr/local/CyberCP/public/rainloop/data /usr/local/lscp/cyberpanel/rainloop/data"
-            #         Upgrade.executioner(command, 0)
-            #
-            #         command = "chown -R lscpd:lscpd /usr/local/lscp/cyberpanel/rainloop/data"
-            #         Upgrade.executioner(command, 0)
-            #
-            #     iPath = os.listdir('/usr/local/CyberCP/public/rainloop/rainloop/v/')
-            #
-            #     path = "/usr/local/CyberCP/public/snappymail/snappymail/v/%s/include.php" % (iPath[0])
-            #
-            #     data = open(path, 'r').readlines()
-            #     writeToFile = open(path, 'w')
-            #
-            #     for items in data:
-            #         if items.find("$sCustomDataPath = '';") > -1:
-            #             writeToFile.writelines(
-            #                 "			$sCustomDataPath = '/usr/local/lscp/cyberpanel/rainloop/data';\n")
-            #         else:
-            #             writeToFile.writelines(items)
-            #
-            #     writeToFile.close()
-            #     return 0
-
+            # Data preservation: only /usr/local/CyberCP/public/snappymail (app files) is replaced.
+            # Data under /usr/local/lscp/cyberpanel/snappymail/data and public/snappymail/data is never deleted.
             cwd = os.getcwd()
 
             if not os.path.exists("/usr/local/CyberCP/public"):
                 os.mkdir("/usr/local/CyberCP/public")
 
-            # Try to fetch latest SnappyMail version from GitHub
-            try:
-                from plogical.versionFetcher import get_latest_snappymail_version
-                latest_version = get_latest_snappymail_version()
-                if latest_version and latest_version != Upgrade.SnappyVersion:
-                    Upgrade.stdOut(f"Using latest SnappyMail version: {latest_version}", 0)
-                    Upgrade.SnappyVersion = latest_version
-                else:
-                    Upgrade.stdOut(f"Using fallback SnappyMail version: {Upgrade.SnappyVersion}", 0)
-            except Exception as e:
-                Upgrade.stdOut(f"Failed to fetch latest SnappyMail version, using fallback: {e}", 0)
+            # Version: /etc/cyberpanel/snappymail_version, then latest from API, then fallback
+            snappy_version = Upgrade.SnappyVersion
+            version_file = '/etc/cyberpanel/snappymail_version'
+            if os.path.isfile(version_file):
+                try:
+                    with open(version_file, 'r') as f:
+                        raw = (f.read() or '').strip()
+                    if raw and len(raw) < 20 and all(c.isdigit() or c == '.' for c in raw):
+                        snappy_version = raw
+                        Upgrade.stdOut(f"Using SnappyMail version from {version_file}: {snappy_version}", 0)
+                except Exception:
+                    pass
+            if snappy_version == Upgrade.SnappyVersion:
+                try:
+                    from plogical.versionFetcher import get_latest_snappymail_version
+                    latest_version = get_latest_snappymail_version()
+                    if latest_version and latest_version != Upgrade.SnappyVersion:
+                        Upgrade.stdOut(f"Using latest SnappyMail version: {latest_version}", 0)
+                        snappy_version = latest_version
+                    else:
+                        Upgrade.stdOut(f"Using fallback SnappyMail version: {Upgrade.SnappyVersion}", 0)
+                except Exception as e:
+                    Upgrade.stdOut(f"Failed to fetch latest SnappyMail version, using fallback: {e}", 0)
 
             os.chdir("/usr/local/CyberCP/public")
 
@@ -1401,7 +1422,7 @@ $cfg['Servers'][$i]['port'] = '3306';
             
             while (1):
                 command = 'wget -q https://github.com/the-djmaze/snappymail/releases/download/v%s/snappymail-%s.zip' % (
-                    Upgrade.SnappyVersion, Upgrade.SnappyVersion)
+                    snappy_version, snappy_version)
                 cmd = shlex.split(command)
                 res = subprocess.call(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
                 if res != 0:
@@ -1415,11 +1436,12 @@ $cfg['Servers'][$i]['port'] = '3306';
 
             count = 0
 
+            # Replace only app tree; data dirs (/usr/local/lscp/cyberpanel/snappymail/data, etc.) are preserved
             if os.path.exists('/usr/local/CyberCP/public/snappymail'):
                 shutil.rmtree('/usr/local/CyberCP/public/snappymail')
 
             while (1):
-                command = 'unzip -q snappymail-%s.zip -d /usr/local/CyberCP/public/snappymail' % (Upgrade.SnappyVersion)
+                command = 'unzip -q snappymail-%s.zip -d /usr/local/CyberCP/public/snappymail' % (snappy_version,)
 
                 cmd = shlex.split(command)
                 res = subprocess.call(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
@@ -1430,7 +1452,7 @@ $cfg['Servers'][$i]['port'] = '3306';
                 else:
                     break
             try:
-                os.remove("snappymail-%s.zip" % (Upgrade.SnappyVersion))
+                os.remove("snappymail-%s.zip" % (snappy_version,))
             except:
                 pass
 
@@ -4510,14 +4532,20 @@ echo $oConfig->Save() ? 'Done' : 'Error';
             subprocess.run(command, shell=True, capture_output=True)
             
             # Install MariaDB from official repository (version from /etc/cyberpanel/mariadb_version or default 11.8)
+            # Accept any major.minor supported by mariadb_repo_setup (10.3-10.11, 11.0-11.8, 12.0-12.x); safe regex to avoid injection
             mariadb_ver = "11.8"
             try:
                 mariadb_version_file = "/etc/cyberpanel/mariadb_version"
                 if os.path.isfile(mariadb_version_file):
                     with open(mariadb_version_file, "r") as f:
-                        raw = f.read().strip()
-                        if raw in ("11.8", "12.1"):
-                            mariadb_ver = raw
+                        raw = (f.read() or "").strip()
+                    if raw:
+                        import re
+                        m = re.match(r'^(\d+)\.(\d+)(?:\.\d+)*$', raw)
+                        if m:
+                            major, minor = int(m.group(1)), int(m.group(2))
+                            if (major == 10 and 3 <= minor <= 11) or (major == 11 and 0 <= minor <= 8) or (major == 12 and 0 <= minor <= 99):
+                                mariadb_ver = "%d.%d" % (major, minor)
             except Exception:
                 pass
             Upgrade.stdOut("Setting up official MariaDB %s repository..." % mariadb_ver, 1)
diff --git a/to-do/MARIADB-ROLLBACK-FROM-BACKUP.md b/to-do/MARIADB-ROLLBACK-FROM-BACKUP.md
new file mode 100644
index 000000000..08d5fe850
--- /dev/null
+++ b/to-do/MARIADB-ROLLBACK-FROM-BACKUP.md
@@ -0,0 +1,33 @@
+# MariaDB rollback using upgrade backups
+
+When you run a CyberPanel upgrade with MariaDB version change, an optional full backup of all databases can be created in two places:
+
+1. **Legacy path:** `/root/cyberpanel_mariadb_backups/mariadb_backup_before_upgrade_YYYYMMDD_HHMMSS.sql.gz`
+2. **Standard path:** `/root/db-upgrade-backups/YYYY-MM-DD_HHMMSS/all_databases.sql.gz`
+
+To roll back to the previous MariaDB state (e.g. after a failed or undesired upgrade):
+
+1. Stop MariaDB: `systemctl stop mariadb` (or `mysql`/`mysqld` on your system).
+2. Restore the dump (example for the standard path):
+   ```bash
+   BACKUP_DIR="/root/db-upgrade-backups/2026-02-17_010304"  # use your actual folder
+   gunzip -c "$BACKUP_DIR/all_databases.sql.gz" | mariadb --skip-ssl -u root -p
+   ```
+   Or if the backup is in the legacy location:
+   ```bash
+   gunzip -c /root/cyberpanel_mariadb_backups/mariadb_backup_before_upgrade_*.sql.gz | mariadb --skip-ssl -u root -p
+   ```
+   You will be prompted for the MariaDB root password (stored in `/etc/cyberpanel/mysqlPassword`).
+3. If you need to reinstall the previous MariaDB server version, use the official MariaDB repo for that version, then start the service and run `mariadb-upgrade --force` if required.
+
+**Note:** Restoring over an existing data directory is destructive. Only use this when you intend to replace the current databases with the backup. For a safe test, back up the current `/var/lib/mysql` first.
+
+## Optional standalone version managers
+
+For advanced MariaDB/phpMyAdmin version changes without running the full upgrade, you can use the community scripts from [cyberpanel-mods](https://github.com/master3395/cyberpanel-mods) (version-managers):
+
+- [mariadb_version_manager_enhanced.sh](https://github.com/master3395/cyberpanel-mods/blob/main/version-managers/mariadb_version_manager_enhanced.sh) – interactive MariaDB version manager (backup, remove, add repo, install, secure).
+- [mariadb_v_changer.sh](https://github.com/master3395/cyberpanel-mods/blob/main/version-managers/mariadb_v_changer.sh) – simple prompt-based MariaDB version changer.
+- [phpmyadmin_v_changer.sh](https://github.com/master3395/cyberpanel-mods/blob/main/version-managers/phpmyadmin_v_changer.sh) – phpMyAdmin version changer (preserves config/signon).
+
+CyberPanel install/upgrade now integrates equivalent behaviour (version choice, backup path, config preservation) so these scripts are optional for users who prefer a standalone workflow.
diff --git a/upgrade_modules/03_mariadb.sh b/upgrade_modules/03_mariadb.sh
index 8fe8ddb4e..dd0666999 100644
--- a/upgrade_modules/03_mariadb.sh
+++ b/upgrade_modules/03_mariadb.sh
@@ -14,7 +14,7 @@ Pre_Upgrade_CentOS7_MySQL() {
     mv /etc/cnfbackup/my.cnf.d /etc/
     systemctl enable mariadb 2>/dev/null || systemctl enable mysql
     systemctl start mariadb 2>/dev/null || systemctl start mysql
-    mariadb-upgrade -uroot -p"$MySQL_Password" 2>/dev/null || mysql_upgrade -uroot -p"$MySQL_Password"
+    mariadb-upgrade --force -uroot -p"$MySQL_Password" 2>/dev/null || mysql_upgrade --force -uroot -p"$MySQL_Password" 2>/dev/null || true
   fi
   mariadb -uroot -p"$MySQL_Password" -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY '$MySQL_Password';flush privileges" 2>/dev/null || mysql -uroot -p"$MySQL_Password" -e "GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY '$MySQL_Password';flush privileges"
   Ensure_MariaDB_Client_No_SSL
@@ -41,6 +41,8 @@ Maybe_Backup_MariaDB_Before_Upgrade() {
 
 Backup_MariaDB_Before_Upgrade() {
   local pass="" backup_dir="/root/cyberpanel_mariadb_backups" backup_file=""
+  local std_backup_base="/root/db-upgrade-backups"
+  local std_backup_dir="${std_backup_base}/$(date +%Y-%m-%d_%H%M%S)"
   echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] Starting MariaDB pre-upgrade backup... (this may take a few minutes)" | tee -a /var/log/cyberpanel_upgrade_debug.log
   [[ -f /etc/cyberpanel/mysqlPassword ]] || { echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] MariaDB pre-upgrade backup: skipped (no password file)." | tee -a /var/log/cyberpanel_upgrade_debug.log; return 0; }
   if grep -q '"mysqlpassword"' /etc/cyberpanel/mysqlPassword 2>/dev/null; then
@@ -55,6 +57,8 @@ Backup_MariaDB_Before_Upgrade() {
     (mariadb-dump --skip-ssl -u root -p"$pass" --all-databases --single-transaction --routines --triggers --events 2>/dev/null || mysqldump --skip-ssl -u root -p"$pass" --all-databases --single-transaction --routines --triggers --events 2>/dev/null) | gzip > "$backup_file" 2>/dev/null
     if [[ -s "$backup_file" ]]; then
       echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] MariaDB backup created: $backup_file" | tee -a /var/log/cyberpanel_upgrade_debug.log
+      mkdir -p "$std_backup_dir"
+      cp -a "$backup_file" "$std_backup_dir/all_databases.sql.gz" 2>/dev/null && echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] MariaDB backup also saved to: $std_backup_dir/all_databases.sql.gz" | tee -a /var/log/cyberpanel_upgrade_debug.log || true
       echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] MariaDB pre-upgrade backup: done." | tee -a /var/log/cyberpanel_upgrade_debug.log
     else
       echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] WARNING: MariaDB backup file empty or failed." | tee -a /var/log/cyberpanel_upgrade_debug.log
diff --git a/upgrade_modules/05_repository.sh b/upgrade_modules/05_repository.sh
index 48f38cc57..27a4f8080 100644
--- a/upgrade_modules/05_repository.sh
+++ b/upgrade_modules/05_repository.sh
@@ -259,7 +259,8 @@ EOF
       sed -i 's|https://yum.mariadb.org/RPM-GPG-KEY-MariaDB|https://cyberpanel.sh/yum.mariadb.org/RPM-GPG-KEY-MariaDB|g' /etc/yum.repos.d/MariaDB.repo
     fi
     dnf clean metadata --disablerepo='*' --enablerepo=mariadb 2>/dev/null || true
-    # MariaDB 10 -> 11 or 11 -> 12: RPM scriptlet blocks in-place upgrade; do manual stop, remove old server, install target, start, mariadb-upgrade
+    # MariaDB 10 -> 11 or 11 -> 12: RPM scriptlet blocks in-place upgrade; do manual stop, remove old server, install target, start, mariadb-upgrade.
+    # Data in /var/lib/mysql is preserved; no databases are dropped.
     MARIADB_OLD_10=$(rpm -qa 'MariaDB-server-10*' 2>/dev/null | head -1)
     [[ -z "$MARIADB_OLD_10" ]] && MARIADB_OLD_10=$(rpm -qa 2>/dev/null | grep -E '^MariaDB-server-10\.' | head -1)
     MARIADB_OLD_11=$(rpm -qa 'MariaDB-server-11*' 2>/dev/null | head -1)
@@ -278,7 +279,7 @@ EOF
       printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
       systemctl start mariadb 2>/dev/null || true
       sleep 2
-      mariadb-upgrade -u root 2>/dev/null || true
+      mariadb-upgrade --force -u root 2>/dev/null || true
       echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] MariaDB manual upgrade to $MARIADB_VER_REPO completed." | tee -a /var/log/cyberpanel_upgrade_debug.log
     elif [[ -n "$MARIADB_OLD_11" ]] && [[ "$MARIADB_VER_REPO" =~ ^12\. ]]; then
       echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] MariaDB 11.x detected; performing manual upgrade to $MARIADB_VER_REPO (stop, remove, install, start, mariadb-upgrade)..." | tee -a /var/log/cyberpanel_upgrade_debug.log
@@ -292,7 +293,7 @@ EOF
       printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
       systemctl start mariadb 2>/dev/null || true
       sleep 2
-      mariadb-upgrade -u root 2>/dev/null || true
+      mariadb-upgrade --force -u root 2>/dev/null || true
       echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] MariaDB manual upgrade to $MARIADB_VER_REPO completed (11->12)." | tee -a /var/log/cyberpanel_upgrade_debug.log
     else
       # Normal install/upgrade (same version or 10.11)
@@ -315,7 +316,7 @@ EOF
           printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
           systemctl start mariadb 2>/dev/null || true
           sleep 2
-          mariadb-upgrade -u root 2>/dev/null || true
+          mariadb-upgrade --force -u root 2>/dev/null || true
           echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] MariaDB manual 11->12 fallback completed." | tee -a /var/log/cyberpanel_upgrade_debug.log
         fi
       fi
@@ -366,7 +367,7 @@ EOF
       printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
       systemctl start mariadb 2>/dev/null || true
       sleep 2
-      mariadb-upgrade -u root 2>/dev/null || true
+      mariadb-upgrade --force -u root 2>/dev/null || true
       echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] MariaDB manual upgrade to $MARIADB_VER_REPO completed (AlmaLinux 9)." | tee -a /var/log/cyberpanel_upgrade_debug.log
     elif [[ -n "$MARIADB_OLD_11_AL9" ]] && [[ "$MARIADB_VER_REPO" =~ ^12\. ]]; then
       echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] MariaDB 11.x detected (AlmaLinux 9); manual upgrade to $MARIADB_VER_REPO..." | tee -a /var/log/cyberpanel_upgrade_debug.log
@@ -380,7 +381,7 @@ EOF
       printf "[client]\nssl=0\nskip-ssl\n" > /etc/my.cnf.d/cyberpanel-client.cnf 2>/dev/null || true
       systemctl start mariadb 2>/dev/null || true
       sleep 2
-      mariadb-upgrade -u root 2>/dev/null || true
+      mariadb-upgrade --force -u root 2>/dev/null || true
       echo -e "[$(date +"%Y-%m-%d %H:%M:%S")] MariaDB manual upgrade to $MARIADB_VER_REPO completed (AlmaLinux 9, 11->12)." | tee -a /var/log/cyberpanel_upgrade_debug.log
     else
       dnf install -y --enablerepo=mariadb MariaDB-server MariaDB-devel 2>/dev/null || dnf install -y mariadb-server mariadb-devel