diff --git a/README.rst b/README.rst
index 38d2413..1c5df0f 100644
--- a/README.rst
+++ b/README.rst
@@ -100,6 +100,7 @@
         query_cache_limit: 16M
         query_cache_size: 96M
         force_encoding: utf8
+        sql_mode: "ONLY_FULL_GROUP_BY,STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION"
         database:
           name:
             encoding: 'utf8'
diff --git a/mysql/conf/my.cnf.Debian b/mysql/conf/my.cnf.Debian
index 77d2d16..9a1c0e4 100644
--- a/mysql/conf/my.cnf.Debian
+++ b/mysql/conf/my.cnf.Debian
@@ -54,6 +54,11 @@
 tmpdir         = /tmp
 lc-messages-dir = /usr/share/mysql
 skip-external-locking
+
+{%- if server.sql_mode is defined %}
+sql-mode={{ server.sql_mode }}
+{%- endif %}
+
 #
 # Instead of skip-networking the default is now to listen only on
 # localhost which is more compatible and is not less secure.