diff --git a/borgmatic/config/schema.yaml b/borgmatic/config/schema.yaml
index 4087e7eb..494b0d70 100644
--- a/borgmatic/config/schema.yaml
+++ b/borgmatic/config/schema.yaml
@@ -1560,23 +1560,6 @@ properties:
                         Defaults to the "password" option. Supports the
                         "{credential ...}" syntax.
                     example: trustsome1
-                password_transport:
-                    type: string
-                    enum:
-                        - pipe
-                        - environment
-                    description: |
-                        How to transmit database passwords from borgmatic to the
-                        MariaDB client, one of:
-                         * "pipe": Securely transmit passwords via anonymous
-                           pipe. Only works if the database client is on the same
-                           host as borgmatic. (The server can be somewhere else.)
-                           This is the default value.
-                         * "environment": Transmit passwords via environment
-                           variable. Potentially less secure than a pipe, but
-                           necessary when the database client is elsewhere, e.g.
-                           when "mariadb_dump_command" is configured to "exec"
-                           into a container and run a client there.
                 tls:
                     type: boolean
                     description: |
diff --git a/borgmatic/hooks/data_source/mariadb.py b/borgmatic/hooks/data_source/mariadb.py
index a4bce92d..1f140793 100644
--- a/borgmatic/hooks/data_source/mariadb.py
+++ b/borgmatic/hooks/data_source/mariadb.py
@@ -120,15 +120,13 @@ def database_names_to_dump(database, config, username, password, environment, dr
         shlex.quote(part) for part in shlex.split(database.get('mariadb_command') or 'mariadb')
     )
     extra_options, defaults_extra_filename = parse_extra_options(database.get('list_options'))
-    password_transport = config.get('password_transport', 'pipe')
     show_command = (
         mariadb_show_command
-        + (make_defaults_file_options(username, password, defaults_extra_filename) if password_transport == 'pipe' else ())
+        + make_defaults_file_options(username, password, defaults_extra_filename)
         + extra_options
         + (('--host', database['hostname']) if 'hostname' in database else ())
         + (('--port', str(database['port'])) if 'port' in database else ())
         + (('--protocol', 'tcp') if 'hostname' in database or 'port' in database else ())
-        + (('--user', username) if username and password_transport == 'environment' else ())
         + (('--ssl',) if database.get('tls') is True else ())
         + (('--skip-ssl',) if database.get('tls') is False else ())
         + ('--skip-column-names', '--batch')
@@ -186,16 +184,14 @@ def execute_dump_command(
         for part in shlex.split(database.get('mariadb_dump_command') or 'mariadb-dump')
     )
     extra_options, defaults_extra_filename = parse_extra_options(database.get('options'))
-    password_transport = config.get('password_transport', 'pipe')
     dump_command = (
         mariadb_dump_command
-        + (make_defaults_file_options(username, password, defaults_extra_filename) if password_transport == 'pipe' else ())
+        + make_defaults_file_options(username, password, defaults_extra_filename)
         + extra_options
         + (('--add-drop-database',) if database.get('add_drop_database', True) else ())
         + (('--host', database['hostname']) if 'hostname' in database else ())
         + (('--port', str(database['port'])) if 'port' in database else ())
         + (('--protocol', 'tcp') if 'hostname' in database or 'port' in database else ())
-        + (('--user', username) if username and password_transport == 'environment' else ())
         + (('--ssl',) if database.get('tls') is True else ())
         + (('--skip-ssl',) if database.get('tls') is False else ())
         + ('--databases',)
@@ -259,7 +255,7 @@ def dump_data_sources(
         password = borgmatic.hooks.credential.parse.resolve_credential(
             database.get('password'), config
         )
-        environment = dict(os.environ, **({'MYSQL_PWD': password} if password and config.get('password_transport') == 'environment' else {}))
+        environment = dict(os.environ)
         dump_database_names = database_names_to_dump(
             database, config, username, password, environment, dry_run
         )
@@ -387,20 +383,18 @@ def restore_data_source_dump(
         shlex.quote(part) for part in shlex.split(data_source.get('mariadb_command') or 'mariadb')
     )
     extra_options, defaults_extra_filename = parse_extra_options(data_source.get('restore_options'))
-    password_transport = config.get('password_transport', 'pipe')
     restore_command = (
         mariadb_restore_command
-        + (make_defaults_file_options(username, password, defaults_extra_filename) if password_transport == 'pipe' else ())
+        + make_defaults_file_options(username, password, defaults_extra_filename)
         + extra_options
         + ('--batch',)
         + (('--host', hostname) if hostname else ())
         + (('--port', str(port)) if port else ())
         + (('--protocol', 'tcp') if hostname or port else ())
-        + (('--user', username) if username and password_transport == 'environment' else ())
         + (('--ssl',) if tls is True else ())
         + (('--skip-ssl',) if tls is False else ())
     )
-    environment = dict(os.environ, **({'MYSQL_PWD': password} if password and password_transport == 'environment' else {}))
+    environment = dict(os.environ)
 
     logger.debug(f"Restoring MariaDB database {data_source['name']}{dry_run_label}")
     if dry_run: