diff --git a/docker/gerrit/base/Dockerfile b/docker/gerrit/base/Dockerfile
index de30011cc1..2daaa19a8a 100644
--- a/docker/gerrit/base/Dockerfile
+++ b/docker/gerrit/base/Dockerfile
@@ -25,8 +25,7 @@ FROM docker.io/library/openjdk:11-bullseye as gerrit-base
 RUN echo 'APT::Install-Recommends "0";' > /etc/apt/apt.conf.d/95disable-recommends
 
 RUN apt-get update \
-  && apt-get install -y dumb-init python3-launchpadlib python3-distutils \
-      wget unzip \
+  && apt-get install -y dumb-init python3-launchpadlib python3-distutils unzip \
   && apt-get clean \
   && rm -rf /var/lib/apt/lists/* \
   && curl https://bootstrap.pypa.io/get-pip.py > /tmp/get-pip.py \
@@ -60,8 +59,9 @@ RUN mkdir /var/gerrit/bin \
 # Download mariadb java client.
 # Modern gerrit stopped downloading missing libs during init which means we
 # need to do the downland and install ourselves.
-RUN mkdir /var/gerrit/lib && \
-  wget https://repo1.maven.org/maven2/org/mariadb/jdbc/mariadb-java-client/2.7.2/mariadb-java-client-2.7.2.jar -O /var/gerrit/lib/mariadb-java-client.jar
+# Note the perms on this are 0600 hence the need for the chown otherwise
+# they are root owned and Gerrit can't use the jdbc driver.
+ADD --chown=gerrit:gerrit https://repo1.maven.org/maven2/org/mariadb/jdbc/mariadb-java-client/2.7.2/mariadb-java-client-2.7.2.jar /var/gerrit/lib/mariadb-java-client.jar
 
 # Allow incoming traffic
 # OpenDev Gerrit listens on 8081 not default of 8080