diff --git a/server/src/telemetry/scrub.ts b/server/src/telemetry/scrub.ts
index 731b4b8415..2b7dac5af0 100644
--- a/server/src/telemetry/scrub.ts
+++ b/server/src/telemetry/scrub.ts
@@ -57,7 +57,7 @@ const RULES: [RegExp, (match: string, ...groups: string[]) => string][] = [
   // `-psecret` for mysql and friends. Nothing separates them: a space means the password is asked for
   // at the prompt and the word after `-p` is the database, so only the attached form is redacted.
   [
-    /(\bmysql(?:dump)?\b(?:[^|;&\\\r\n]|\\[\s\S])*?(?:[ \t]|\\\r?\n)-p)("[^"]*"|'[^']*'|[^\s'"-]\S*)/gi,
+    /(\bmysql(?:dump)?\b(?:[^|;&\\\r\n]|\\[\s\S])*?(?:[ \t]|\\\r?\n)-p)("[^"]*"|'[^']*'|[^\s'"-]\S*)/g,
     (_m, lead) => `${lead}${REDACTED}`,
   ],
   // `docker login -p secret`, where `-p` is the password rather than a port.
diff --git a/server/tests/enterprise-controls.test.ts b/server/tests/enterprise-controls.test.ts
index d1da9ce03a..23927b95f9 100644
--- a/server/tests/enterprise-controls.test.ts
+++ b/server/tests/enterprise-controls.test.ts
@@ -359,6 +359,11 @@ describe("scrubbing commands", () => {
       "psql postgres://app:[REDACTED]@db:5432/app",
     ],
     ["mysql -uroot -phunter2 app", "mysql -uroot -p[REDACTED] app"],
+    // `-P` is mysql's port, not its password: the attached port must survive and the real
+    // password later in the same command must still be redacted (gh-815).
+    ["mysql -h db -P3306 -phunter2 app", "mysql -h db -P3306 -p[REDACTED] app"],
+    ["mysql -uroot -p3306 app", "mysql -uroot -p[REDACTED] app"],
+    ["mysqldump -phunter2 db", "mysqldump -p[REDACTED] db"],
     [
       "tool --password hunter2 --verbose",
       "tool --password [REDACTED] --verbose",