diff --git a/internal/testserver/datastore/mysql.go b/internal/testserver/datastore/mysql.go
index d3ee02fc97..a28cfaa39c 100644
--- a/internal/testserver/datastore/mysql.go
+++ b/internal/testserver/datastore/mysql.go
@@ -21,6 +21,7 @@ import (
 
 const (
 	mysqlPort    = 3306
+	mysqlPortStr = "3306/tcp"
 	defaultCreds = "root:secret"
 	testDBPrefix = "spicedb_test_"
 )
@@ -59,11 +60,12 @@ func RunMySQLForTestingWithOptions(t testing.TB, options MySQLTesterOptions, bri
 
 	name := fmt.Sprintf("mysql-%s", uuid.New().String())
 	resource, err := pool.RunWithOptions(&dockertest.RunOptions{
-		Name:       name,
-		Repository: "mysql",
-		Tag:        containerImageTag,
-		Platform:   "linux/amd64", // required because the mysql:5 image does not have arm support
-		Env:        []string{"MYSQL_ROOT_PASSWORD=secret"},
+		Name:         name,
+		Repository:   "mysql",
+		Tag:          containerImageTag,
+		Platform:     "linux/amd64", // required because the mysql:5 image does not have arm support
+		Env:          []string{"MYSQL_ROOT_PASSWORD=secret"},
+		ExposedPorts: []string{mysqlPortStr},
 		// increase max connections (default 151) to accommodate tests using the same docker container
 		Cmd:       []string{"--max-connections=500"},
 		NetworkID: bridgeNetworkName,
@@ -78,7 +80,7 @@ func RunMySQLForTestingWithOptions(t testing.TB, options MySQLTesterOptions, bri
 		require.NoError(t, pool.Purge(resource))
 	})
 
-	port := resource.GetPort(fmt.Sprintf("%d/tcp", mysqlPort))
+	port := resource.GetPort(mysqlPortStr)
 	if bridgeNetworkName != "" {
 		builder.hostname = name
 		builder.port = fmt.Sprintf("%d", mysqlPort)