diff --git a/keyserver/Dockerfile b/keyserver/Dockerfile
--- a/keyserver/Dockerfile
+++ b/keyserver/Dockerfile
@@ -5,9 +5,15 @@
 # Install prereqs first so we don't have to reinstall them if anything changes
 #-------------------------------------------------------------------------------
 
-# We use rsync in the prod-build yarn script
+# We add Debian's unstable repo since it's the only way to get mysqldump
+RUN echo "deb http://deb.debian.org/debian unstable main non-free contrib" \
+  >> /etc/apt/sources.list
+
+# We need rsync in the prod-build yarn script
+# We need mysql-client so we can use mysqldump for backups
 RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
   rsync \
+  mysql-client \
   && rm -rf /var/lib/apt/lists/*
 
 #-------------------------------------------------------------------------------
@@ -20,7 +26,20 @@
 WORKDIR /home/comm/app
 
 #-------------------------------------------------------------------------------
-# STEP 2: INSTALL NVM
+# STEP 2: SET UP MYSQL BACKUPS
+# Prepare the system to properly handle mysqldump backups
+#-------------------------------------------------------------------------------
+
+# Prepare the directory that will hold the backups
+RUN mkdir /home/comm/backups
+
+# We install mysql-client 8.0 above but use it with MySQL 5.7. Unfortunately,
+# we haven't been able to figure out a way to install mysql-client 5.7 on
+# Debian bullseye. Instead, we configure mysqldump 8.0 to work with MySQL 5.7
+RUN echo "[mysqldump]\ncolumn-statistics=0" > /home/comm/.my.cnf
+
+#-------------------------------------------------------------------------------
+# STEP 3: INSTALL NVM
 # We use nvm to make sure we're running the right Node version
 #-------------------------------------------------------------------------------
 
@@ -29,7 +48,7 @@
   | bash
 
 #-------------------------------------------------------------------------------
-# STEP 3: YARN CLEANINSTALL
+# STEP 4: YARN CLEANINSTALL
 # We run yarn cleaninstall before copying most of the files in for build caching
 #-------------------------------------------------------------------------------
 
@@ -50,7 +69,7 @@
 RUN yarn cleaninstall
 
 #-------------------------------------------------------------------------------
-# STEP 4: WEBPACK BUILD
+# STEP 5: WEBPACK BUILD
 # We do this first so Docker doesn't rebuild when only keyserver files change
 #-------------------------------------------------------------------------------
 
@@ -62,14 +81,14 @@
 RUN yarn workspace web prod
 
 #-------------------------------------------------------------------------------
-# STEP 5: COPY IN SOURCE FILES
+# STEP 6: COPY IN SOURCE FILES
 # We run this later so the above layers are cached if only source files change
 #-------------------------------------------------------------------------------
 
 COPY --chown=comm . .
 
 #-------------------------------------------------------------------------------
-# STEP 6: RUN BUILD SCRIPTS
+# STEP 7: RUN BUILD SCRIPTS
 # We need to populate keyserver/dist, among other things
 #-------------------------------------------------------------------------------
 
@@ -77,7 +96,7 @@
 RUN yarn workspace keyserver prod-build
 
 #-------------------------------------------------------------------------------
-# STEP 7: RUN THE SERVER
+# STEP 8: RUN THE SERVER
 # Actually run the Node.js keyserver using nvm
 #-------------------------------------------------------------------------------