diff --git a/.github/actions/download/action.yml b/.github/actions/download/action.yml
new file mode 100644
index 00000000000..cfb4e283c80
--- /dev/null
+++ b/.github/actions/download/action.yml
@@ -0,0 +1,25 @@
+name: 'Download artifact'
+description: 'Download artifacts with normalized names'
+inputs:
+  name:
+    required: true
+    type: string
+  path:
+    required: true
+    type: string
+
+runs:
+  using: "composite"
+  steps:
+    - name: Normalise name
+      run: |
+        name=${{ inputs.name }}
+        echo "NAME=${name//\//_}" >> "$GITHUB_ENV"
+      shell: bash
+
+    - name: Download artifact
+      uses: actions/download-artifact@v4
+      with:
+        name: ${{ env.NAME }}
+        path: ${{ inputs.path }}
+
diff --git a/.github/actions/upload/action.yml b/.github/actions/upload/action.yml
new file mode 100644
index 00000000000..927974ad581
--- /dev/null
+++ b/.github/actions/upload/action.yml
@@ -0,0 +1,33 @@
+name: 'Upload artifact'
+description: 'Upload artifacts with normalized names'
+inputs:
+  if-no-files-found:
+    default: 'error'
+    type: string
+  name:
+    required: true
+    type: string
+  path:
+    required: true
+    type: string
+  retention-days:
+    default: 0
+    type: number
+
+runs:
+  using: "composite"
+  steps:
+    - name: Normalise name
+      run: |
+        name=${{ inputs.name }}
+        echo "NAME=${name//\//_}" >> "$GITHUB_ENV"
+      shell: bash
+
+    - name: Upload artifact
+      uses: actions/upload-artifact@v4
+      with:
+        if-no-files-found: ${{ inputs.if-no-files-found }}
+        retention-days: ${{ inputs.retention-days }}
+        name: ${{ env.NAME }}
+        path: ${{ inputs.path }}
+
diff --git a/.github/scripts/build.bash b/.github/scripts/build.bash
new file mode 100644
index 00000000000..27263fc822b
--- /dev/null
+++ b/.github/scripts/build.bash
@@ -0,0 +1,55 @@
+set -eux
+
+uname -a
+uname -p
+uname
+pwd
+env
+
+if [ "${RUNNER_OS}" = Windows ] ; then
+    ext=".exe"
+else
+    ext=""
+fi
+
+ghcup --no-verbose install ghc --set --install-targets "${GHC_TARGETS}" "${GHC_VERSION}"
+
+cabal update
+cabal user-config diff
+cabal user-config init -f
+"ghc-${GHC_VERSION}" --info
+"ghc" --info
+
+# shellcheck disable=SC2206
+args=(
+    -w "ghc-$GHC_VERSION"
+    --disable-profiling
+    --enable-executable-stripping
+    --project-file=cabal.release.project
+    ${ADD_CABAL_ARGS}
+)
+
+cabal v2-build "${args[@]}" cabal-install
+
+mkdir -p "out"
+# shellcheck disable=SC2154
+cp "$(cabal list-bin "${args[@]}" cabal-install:exe:cabal)" "out/cabal$ext"
+cp dist-newstyle/cache/plan.json "out/plan.json"
+cd "out/"
+
+# create tarball/zip
+TARBALL_PREFIX="cabal-install-$("./cabal" --numeric-version)"
+case "${TARBALL_EXT}" in
+    zip)
+        zip "${TARBALL_PREFIX}-${ARTIFACT}.${TARBALL_EXT}" "cabal${ext}" plan.json
+        ;;
+    tar.xz)
+        tar caf "${TARBALL_PREFIX}-${ARTIFACT}.${TARBALL_EXT}" "cabal${ext}" plan.json
+        ;;
+    *)
+        fail "Unknown TARBALL_EXT: ${TARBALL_EXT}"
+        ;;
+esac
+
+rm "cabal${ext}" plan.json
+
diff --git a/.github/scripts/test.bash b/.github/scripts/test.bash
new file mode 100644
index 00000000000..9c83dbb32d7
--- /dev/null
+++ b/.github/scripts/test.bash
@@ -0,0 +1,34 @@
+set -eux
+
+env
+pwd
+ls -lah
+
+cd out
+case "${TARBALL_EXT}" in
+    zip)
+        unzip ./cabal-install-*-"${ARTIFACT}.${TARBALL_EXT}"
+        ;;
+    tar.xz)
+        tar xf ./cabal-install-*-"${ARTIFACT}.${TARBALL_EXT}"
+        ;;
+    *)
+        fail "Unknown TARBALL_EXT: ${TARBALL_EXT}"
+        ;;
+esac
+cd ..
+
+ghcup --no-verbose install ghc --set --install-targets "${GHC_TEST_TARGETS}" "${GHC_TEST_VERSION}"
+
+cabal update
+
+# TODO: we want to avoid building here... we should just
+# be using the previously built 'cabal-tests' binary
+# Also see https://github.com/haskell/cabal/issues/11048
+cabal run -w "ghc-${GHC_TEST_VERSION}" ${ADD_CABAL_ARGS} cabal-testsuite:cabal-tests -- \
+  --with-cabal "$(pwd)/out/cabal" \
+  --intree-cabal-lib "$(pwd)" \
+  --test-tmp "$(pwd)/testdb" \
+  --skip-setup-tests \
+  -j "$(nproc || sysctl -n hw.ncpu || getconf _NPROCESSORS_ONLN || echo 1)"
+
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 00000000000..1a7343ba760
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,87 @@
+name: Build and release
+
+on:
+  push:
+    tags:
+      - 'v*'
+      - 'cabal-install-*'
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+    branches:
+      - master
+  schedule:
+    - cron: '0 0 * * *'
+  workflow_dispatch:
+
+permissions:
+  pull-requests: read
+
+env:
+  BUILD_LABEL: "run release build"
+
+jobs:
+  check-pr-labels:
+    name: check PR labels
+    runs-on: ubuntu-latest
+    outputs:
+      run_release_workflow: ${{ steps.gen_output.outputs.run_release_workflow }}
+    steps:
+      - id: gen_output
+        run: |
+          if [ "${{ github.event.action }}" == 'labeled' ] ; then
+            if [ ${{ github.event.label.name == '${{ env.BUILD_LABEL }}' }} ] ; then
+              echo run_release_workflow="yes" >> "$GITHUB_OUTPUT"
+            else
+              echo run_release_workflow="no" >> "$GITHUB_OUTPUT"
+            fi
+          elif [ "${{ github.event_name }}" = 'pull_request' ] ; then
+            run_it=$(if gh api --jq '.labels.[].name' /repos/${{ github.repository }}/pulls/${{ github.event.number }} | grep --quiet '^${{ env.BUILD_LABEL }}$' ; then printf "%s" "yes" ; else printf "%s" "no" ; fi)
+            echo "${run_it}"
+            echo run_release_workflow="${run_it}" >> "$GITHUB_OUTPUT"
+          else
+            echo run_release_workflow="yes" >> "$GITHUB_OUTPUT"
+          fi
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+  release-workflow:
+    needs: ["check-pr-labels"]
+    if: ${{ needs.check-pr-labels.outputs.run_release_workflow == 'yes' }}
+    uses: ./.github/workflows/reusable-release.yml
+    with:
+      branches: '["${{ github.ref }}"]'
+
+  release:
+    name: release
+    needs: [ "release-workflow" ]
+    runs-on: ubuntu-latest
+    if: ${{ startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch' }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: artifacts-*
+          merge-multiple: true
+          path: ./out
+
+      - name: Install requirements
+        run: |
+          sudo apt-get update && sudo apt-get install -y tar xz-utils
+        shell: bash
+
+      - name: build sdists
+        run: |
+          cabal sdist -o out all
+        shell: bash
+
+      - name: Release
+        uses: softprops/action-gh-release@v1
+        with:
+          draft: true
+          files: |
+            ./out/*
+
diff --git a/.github/workflows/reusable-release.yml b/.github/workflows/reusable-release.yml
new file mode 100644
index 00000000000..9c2e738ab9c
--- /dev/null
+++ b/.github/workflows/reusable-release.yml
@@ -0,0 +1,826 @@
+name: Build and release
+
+on:
+  workflow_call:
+    inputs:
+      branches:
+        required: true
+        type: string
+      ghc:
+        type: string
+        default: 9.10.2
+      # speed up installation by skipping docs
+      # starting with GHC 9.10.x, we also need to pass the 'install_extra' target
+      ghc_targets:
+        type: string
+        default: "install_bin install_lib update_package_db install_extra"
+      cabal:
+        type: string
+        default: 3.14.2.0
+      test:
+        type: boolean
+        default: true
+
+env:
+  GHC_VERSION: ${{ inputs.ghc }}
+  GHC_TARGETS: ${{ inputs.ghc_targets }}
+  # This shouldn't be necessary, but cabal developers
+  # want to build with 9.10.2, which causes test failures
+  # when used as runtime GHC version as well.
+  GHC_TEST_VERSION: 9.6.7
+  GHC_TEST_TARGETS: "install_bin install_lib update_package_db"
+  CABAL_VERSION: ${{ inputs.cabal }}
+  BOOTSTRAP_HASKELL_NONINTERACTIVE: 1
+  BOOTSTRAP_HASKELL_MINIMAL: 1
+  DEBIAN_FRONTEND: noninteractive
+  TZ: Asia/Singapore
+
+jobs:
+  tool-output:
+    runs-on: ubuntu-latest
+    outputs:
+      apt_tools: ${{ steps.gen_output.outputs.apt_tools }}
+      apt_tools_ncurses6: ${{ steps.gen_output.outputs.apt_tools_ncurses6 }}
+      rpm_tools: ${{ steps.gen_output.outputs.rpm_tools }}
+      apk_tools: ${{ steps.gen_output.outputs.apk_tools }}
+      xbps_tools: ${{ steps.gen_output.outputs.xbps_tools }}
+    env:
+      APT: "groff-base libnuma-dev zlib1g-dev libgmp-dev libgmp10 libssl-dev liblzma-dev libbz2-dev git wget lsb-release software-properties-common gnupg2 apt-transport-https gcc autoconf automake build-essential curl ghc gzip libffi-dev libncurses-dev patchelf"
+      RPM: "groff-base autoconf automake binutils bzip2 coreutils curl elfutils-devel elfutils-libs findutils gcc gcc-c++ git gmp gmp-devel jq lbzip2 make ncurses ncurses-compat-libs ncurses-devel openssh-clients patch perl pxz python3 sqlite sudo wget which xz zlib-devel patchelf"
+      APK: "groff binutils-gold curl gcc g++ gmp-dev libc-dev libffi-dev make musl-dev ncurses-dev perl tar xz autoconf automake bzip2 coreutils elfutils-dev findutils git jq bzip2-dev patch python3 sqlite sudo wget which zlib-dev patchelf zlib zlib-dev zlib-static"
+      XBPS: "groff ncurses-libtinfo-libs autoconf automake binutils bzip2 coreutils curl elfutils-devel elfutils findutils gcc gmp gmp-devel jq lbzip2 make ncurses ncurses-devel openssh patch perl python3 sqlite sudo wget which xz tar zlib-devel patchelf gzip"
+    steps:
+      - name: Generate output
+        id: gen_output
+        run: |
+          echo apt_tools="${{ env.APT }} libncurses5 libtinfo5" >> "$GITHUB_OUTPUT"
+          echo apt_tools_ncurses6="${{ env.APT }} libncurses6 libtinfo6" >> "$GITHUB_OUTPUT"
+          echo rpm_tools="${{ env.RPM }}" >> "$GITHUB_OUTPUT"
+          echo apk_tools="${{ env.APK }}" >> "$GITHUB_OUTPUT"
+          echo xbps_tools="${{ env.XBPS }}" >> "$GITHUB_OUTPUT"
+
+  build-linux:
+    name: Build linux binaries
+    runs-on: ubuntu-latest
+    needs: ["tool-output"]
+    env:
+      TARBALL_EXT: tar.xz
+      ARCH: 64
+    strategy:
+      fail-fast: false
+      matrix:
+        branch: ${{ fromJSON(inputs.branches) }}
+        platform: [ { image: "debian:11"
+                    , installCmd: "apt-get update && apt-get install -y"
+                    , toolRequirements: "${{ needs.tool-output.outputs.apt_tools }}"
+                    , DISTRO: "Debian"
+                    , ARTIFACT: "x86_64-linux-deb11"
+                    , ADD_CABAL_ARGS: "--enable-split-sections"
+                    },
+                    { image: "debian:12"
+                    , installCmd: "apt-get update && apt-get install -y"
+                    , toolRequirements: "${{ needs.tool-output.outputs.apt_tools }}"
+                    , DISTRO: "Debian"
+                    , ARTIFACT: "x86_64-linux-deb12"
+                    , ADD_CABAL_ARGS: "--enable-split-sections"
+                    },
+                    { image: "ubuntu:20.04"
+                    , installCmd: "apt-get update && apt-get install -y"
+                    , toolRequirements: "${{ needs.tool-output.outputs.apt_tools }}"
+                    , DISTRO: "Ubuntu"
+                    , ARTIFACT: "x86_64-linux-ubuntu20.04"
+                    , ADD_CABAL_ARGS: "--enable-split-sections"
+                    },
+                    { image: "ubuntu:22.04"
+                    , installCmd: "apt-get update && apt-get install -y"
+                    , toolRequirements: "${{ needs.tool-output.outputs.apt_tools }}"
+                    , DISTRO: "Ubuntu"
+                    , ARTIFACT: "x86_64-linux-ubuntu22.04"
+                    , ADD_CABAL_ARGS: "--enable-split-sections"
+                    },
+                    { image: "ubuntu:24.04"
+                    , installCmd: "apt-get update && apt-get install -y"
+                    , toolRequirements: "${{ needs.tool-output.outputs.apt_tools_ncurses6 }}"
+                    , DISTRO: "Ubuntu"
+                    , ARTIFACT: "x86_64-linux-ubuntu24.04"
+                    , ADD_CABAL_ARGS: "--enable-split-sections"
+                    },
+                    { image: "fedora:33"
+                    , installCmd: "dnf install -y"
+                    , toolRequirements: "${{ needs.tool-output.outputs.rpm_tools }}"
+                    , DISTRO: "Fedora"
+                    , ARTIFACT: "x86_64-linux-fedora33"
+                    , ADD_CABAL_ARGS: "--enable-split-sections"
+                    },
+                    { image: "fedora:36"
+                    , installCmd: "dnf install -y"
+                    , toolRequirements: "${{ needs.tool-output.outputs.rpm_tools }}"
+                    , DISTRO: "Fedora"
+                    , ARTIFACT: "x86_64-linux-fedora36"
+                    , ADD_CABAL_ARGS: "--enable-split-sections"
+                    },
+                    { image: "fedora:38"
+                    , installCmd: "dnf install -y"
+                    , toolRequirements: "${{ needs.tool-output.outputs.rpm_tools }}"
+                    , DISTRO: "Fedora"
+                    , ARTIFACT: "x86_64-linux-fedora38"
+                    , ADD_CABAL_ARGS: "--enable-split-sections"
+                    },
+                    { image: "rockylinux:8"
+                    , installCmd: "yum -y install epel-release && yum install -y --allowerasing"
+                    , toolRequirements: "${{ needs.tool-output.outputs.rpm_tools }}"
+                    , DISTRO: "Unknown"
+                    , ARTIFACT: "x86_64-linux-rocky8"
+                    , ADD_CABAL_ARGS: "--enable-split-sections"
+                    },
+                    { image: "alpine:3.20"
+                    , installCmd: "apk update && apk add"
+                    , toolRequirements: "${{ needs.tool-output.outputs.apk_tools }}"
+                    , DISTRO: "Unknown"
+                    , ARTIFACT: "x86_64-linux-unknown"
+                    , ADD_CABAL_ARGS: "--enable-split-sections --enable-executable-static"
+                    },
+                    { image: "alpine:3.12"
+                    , installCmd: "apk update && apk add"
+                    , toolRequirements: "${{ needs.tool-output.outputs.apk_tools }}"
+                    , DISTRO: "Unknown"
+                    , ARTIFACT: "x86_64-linux-alpine312"
+                    , ADD_CABAL_ARGS: "--enable-split-sections"
+                    },
+                    { image: "alpine:3.20"
+                    , installCmd: "apk update && apk add"
+                    , toolRequirements: "${{ needs.tool-output.outputs.apk_tools }}"
+                    , DISTRO: "Unknown"
+                    , ARTIFACT: "x86_64-linux-alpine320"
+                    , ADD_CABAL_ARGS: "--enable-split-sections"
+                    }
+                  ]
+    container:
+      image: ${{ matrix.platform.image }}
+    steps:
+      - name: Install requirements
+        shell: sh
+        run: |
+          ${{ matrix.platform.installCmd }} curl bash git ${{ matrix.platform.toolRequirements }}
+
+      - name: Install GHCup
+        uses: haskell/ghcup-setup@v1
+        with:
+          cabal: ${{ env.CABAL_VERSION }}
+
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ matrix.branch }}
+
+      - name: Run build
+        run: |
+          bash .github/scripts/build.bash
+
+        env:
+          ARTIFACT: ${{ matrix.platform.ARTIFACT }}
+          DISTRO: ${{ matrix.platform.DISTRO }}
+          ADD_CABAL_ARGS: ${{ matrix.platform.ADD_CABAL_ARGS }}
+
+      - if: always()
+        name: Upload artifact
+        uses: ./.github/actions/upload
+        with:
+          if-no-files-found: error
+          retention-days: 2
+          name: artifacts-${{ matrix.platform.ARTIFACT }}-${{ matrix.branch }}
+          path: |
+            ./out/*
+
+  build-linux-32bit:
+    name: Build linux binaries (32bit)
+    needs: ["tool-output"]
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        branch: ${{ fromJSON(inputs.branches) }}
+    env:
+      TARBALL_EXT: tar.xz
+      ARCH: 32
+      DISTRO: "Unknown"
+      ARTIFACT: "i386-linux-unknown"
+      ADD_CABAL_ARGS: "--enable-split-sections --enable-executable-static"
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ matrix.branch }}
+
+      - name: Run build (32 bit linux)
+        uses: docker://i386/alpine:3.20
+        with:
+          args: sh -c "apk update && apk add curl bash git ${{ needs.tool-output.outputs.apk_tools }} && export PATH=$HOME/.ghcup/bin:$PATH && curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org | sh && ghcup install cabal ${{ env.CABAL_VERSION }} && bash .github/scripts/build.bash"
+
+      - if: always()
+        name: Upload artifact
+        uses: ./.github/actions/upload
+        with:
+          if-no-files-found: error
+          retention-days: 2
+          name: artifacts-${{ env.ARTIFACT }}-${{ matrix.branch }}
+          path: |
+            ./out/*
+
+  build-arm:
+    name: Build ARM binary
+    needs: ["tool-output"]
+    runs-on: ubuntu-22.04-arm
+    env:
+      TARBALL_EXT: tar.xz
+      ADD_CABAL_ARGS: ""
+      ARCH: ARM64
+    strategy:
+      fail-fast: false
+      matrix:
+        branch: ${{ fromJSON(inputs.branches) }}
+        platform: [ { ARCH: "ARM64"
+                    , DISTRO: "Debian"
+                    , ARTIFACT: "aarch64-linux-deb11"
+                    },
+                    { ARCH: "ARM64"
+                    , DISTRO: "Alpine"
+                    , ARTIFACT: "aarch64-linux-unknown"
+                    }
+                  ]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ matrix.branch }}
+
+      - if: matrix.platform.DISTRO == 'Debian'
+        uses: docker://arm64v8/debian:11
+        name: Run build (aarch64 linux)
+        with:
+          args: sh -c "apt-get update && apt-get install -y curl bash git ${{ needs.tool-output.outputs.apt_tools }} && export PATH=$HOME/.ghcup/bin:$PATH && curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org | sh && ghcup install cabal ${{ env.CABAL_VERSION }} && bash .github/scripts/build.bash"
+        env:
+          ARTIFACT: ${{ matrix.platform.ARTIFACT }}
+          DISTRO: ${{ matrix.platform.DISTRO }}
+          ADD_CABAL_ARGS: ""
+
+      - if: matrix.platform.DISTRO == 'Alpine'
+        uses: docker://arm64v8/alpine:3.20
+        name: Run build (aarch64 linux alpine)
+        with:
+          args: sh -c "apk update && apk add curl bash git ${{ needs.tool-output.outputs.apk_tools }} && export PATH=$HOME/.ghcup/bin:$PATH && curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org | sh && ghcup install cabal ${{ env.CABAL_VERSION }} && bash .github/scripts/build.bash"
+        env:
+          ARTIFACT: ${{ matrix.platform.ARTIFACT }}
+          DISTRO: ${{ matrix.platform.DISTRO }}
+          ADD_CABAL_ARGS: "--enable-split-sections --enable-executable-static"
+
+      - if: always()
+        name: Upload artifact
+        uses: ./.github/actions/upload
+        with:
+          if-no-files-found: error
+          retention-days: 2
+          name: artifacts-${{ matrix.platform.ARTIFACT }}-${{ matrix.branch }}
+          path: |
+            ./out/*
+
+  build-mac-x86_64:
+    name: Build binary (Mac x86_64)
+    runs-on: macOS-13
+    env:
+      MACOSX_DEPLOYMENT_TARGET: 10.13
+      ADD_CABAL_ARGS: ""
+      ARTIFACT: "x86_64-apple-darwin"
+      ARCH: 64
+      TARBALL_EXT: tar.xz
+      DISTRO: na
+    strategy:
+      fail-fast: false
+      matrix:
+        branch: ${{ fromJSON(inputs.branches) }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ matrix.branch }}
+
+      - name: Install GHCup
+        uses: haskell/ghcup-setup@v1
+        with:
+          cabal: ${{ env.CABAL_VERSION }}
+
+      - name: Run build
+        run: |
+          bash .github/scripts/build.bash
+
+      - if: always()
+        name: Upload artifact
+        uses: ./.github/actions/upload
+        with:
+          if-no-files-found: error
+          retention-days: 2
+          name: artifacts-${{ env.ARTIFACT }}-${{ matrix.branch }}
+          path: |
+            ./out/*
+
+  build-mac-aarch64:
+    name: Build binary (Mac aarch64)
+    runs-on: macos-latest
+    env:
+      MACOSX_DEPLOYMENT_TARGET: 10.13
+      ADD_CABAL_ARGS: ""
+      ARTIFACT: "aarch64-apple-darwin"
+      ARCH: ARM64
+      TARBALL_EXT: tar.xz
+      DISTRO: na
+      HOMEBREW_CHANGE_ARCH_TO_ARM: 1
+      GHCUP_INSTALL_BASE_PREFIX: ${{ github.workspace }}
+    strategy:
+      fail-fast: false
+      matrix:
+        branch: ${{ fromJSON(inputs.branches) }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ matrix.branch }}
+
+      - name: Install GHCup
+        uses: haskell/ghcup-setup@v1
+        with:
+          cabal: ${{ env.CABAL_VERSION }}
+
+      - name: Run build
+        run: |
+          bash .github/scripts/build.bash
+
+      - if: always()
+        name: Upload artifact
+        uses: ./.github/actions/upload
+        with:
+          if-no-files-found: error
+          retention-days: 2
+          name: artifacts-${{ env.ARTIFACT }}-${{ matrix.branch }}
+          path: |
+            ./out/*
+
+  build-win:
+    name: Build binary (Win)
+    runs-on: windows-latest
+    env:
+      ADD_CABAL_ARGS: ""
+      ARTIFACT: "x86_64-mingw64"
+      ARCH: 64
+      TARBALL_EXT: "zip"
+      DISTRO: na
+      CABAL_DIR: "C:\\Users\\runneradmin\\AppData\\Roaming\\cabal"
+      GHCUP_INSTALL_BASE_PREFIX: "/c"
+    strategy:
+      fail-fast: false
+      matrix:
+        branch: ${{ fromJSON(inputs.branches) }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ matrix.branch }}
+
+      - name: install windows deps
+        shell: pwsh
+        run: |
+          # https://www.msys2.org/docs/updating/
+          C:\msys64\usr\bin\bash -lc "pacman --disable-download-timeout --noconfirm -Syuu"
+          C:\msys64\usr\bin\bash -lc "pacman --disable-download-timeout --noconfirm -Syuu"
+          C:\msys64\usr\bin\bash -lc "pacman --disable-download-timeout --noconfirm -S make mingw-w64-x86_64-clang curl autoconf mingw-w64-x86_64-pkgconf ca-certificates base-devel gettext autoconf make libtool automake python p7zip patch unzip zip git"
+          taskkill /F /FI "MODULES eq msys-2.0.dll"
+
+      - name: Install GHCup
+        uses: haskell/ghcup-setup@v1
+        with:
+          cabal: ${{ env.CABAL_VERSION }}
+
+      - name: Run build (windows)
+        run: |
+          $env:CHERE_INVOKING = 1
+          $env:MSYS2_PATH_TYPE = "inherit"
+          $ErrorActionPreference = "Stop"
+          C:\msys64\usr\bin\bash -lc "bash .github/scripts/build.bash"
+        shell: pwsh
+
+      - if: always()
+        name: Upload artifact
+        uses: ./.github/actions/upload
+        with:
+          if-no-files-found: error
+          retention-days: 2
+          name: artifacts-${{ env.ARTIFACT }}-${{ matrix.branch }}
+          path: |
+            ./out/*
+
+  build-freebsd-x86_64:
+    name: Build FreeBSD x86_64
+    runs-on: [self-hosted, FreeBSD, X64]
+    env:
+      ADD_CABAL_ARGS: ""
+      ARTIFACT: "x86_64-portbld-freebsd"
+      ARCH: 64
+      TARBALL_EXT: tar.xz
+      DISTRO: na
+      RUNNER_OS: FreeBSD
+      CABAL_DIR: ${{ github.workspace }}/.cabal
+      GHCUP_INSTALL_BASE_PREFIX: ${{ github.workspace }}
+    strategy:
+      fail-fast: false
+      matrix:
+        branch: ${{ fromJSON(inputs.branches) }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ matrix.branch }}
+
+      - name: Install GHCup
+        uses: haskell/ghcup-setup@v1
+        with:
+          cabal: ${{ env.CABAL_VERSION }}
+
+      - name: Run build
+        run: |
+          sudo sed -i.bak -e 's/quarterly/latest/' /etc/pkg/FreeBSD.conf
+          sudo pkg install -y curl gcc gmp gmake ncurses perl5 pkgconf libffi libiconv git bash misc/compat10x misc/compat11x misc/compat12x
+          sudo tzsetup Etc/GMT
+          sudo adjkerntz -a
+          bash .github/scripts/build.bash
+
+      - if: always()
+        name: Upload artifact
+        uses: ./.github/actions/upload
+        with:
+          if-no-files-found: error
+          retention-days: 2
+          name: artifacts-${{ env.ARTIFACT }}-${{ matrix.branch }}
+          path: |
+            ./out/*
+
+  test-linux:
+    name: Test linux binaries
+    runs-on: ubuntu-latest
+    needs: ["tool-output", "build-linux"]
+    if: ${{ inputs.test }}
+    env:
+      TARBALL_EXT: tar.xz
+      ARCH: 64
+      ADD_CABAL_ARGS: ""
+    strategy:
+      fail-fast: false
+      matrix:
+        branch: ${{ fromJSON(inputs.branches) }}
+        platform: [ { image: "debian:11"
+                    , installCmd: "apt-get update && apt-get install -y"
+                    , toolRequirements: "${{ needs.tool-output.outputs.apt_tools }}"
+                    , DISTRO: "Debian"
+                    , ARTIFACT: "x86_64-linux-deb11"
+                    },
+                    { image: "debian:12"
+                    , installCmd: "apt-get update && apt-get install -y"
+                    , toolRequirements: "${{ needs.tool-output.outputs.apt_tools }}"
+                    , DISTRO: "Debian"
+                    , ARTIFACT: "x86_64-linux-deb12"
+                    },
+                    { image: "ubuntu:20.04"
+                    , installCmd: "apt-get update && apt-get install -y"
+                    , toolRequirements: "${{ needs.tool-output.outputs.apt_tools }}"
+                    , DISTRO: "Ubuntu"
+                    , ARTIFACT: "x86_64-linux-ubuntu20.04"
+                    },
+                    { image: "ubuntu:22.04"
+                    , installCmd: "apt-get update && apt-get install -y"
+                    , toolRequirements: "${{ needs.tool-output.outputs.apt_tools }}"
+                    , DISTRO: "Ubuntu"
+                    , ARTIFACT: "x86_64-linux-ubuntu22.04"
+                    },
+                    { image: "ubuntu:24.04"
+                    , installCmd: "apt-get update && apt-get install -y"
+                    , toolRequirements: "${{ needs.tool-output.outputs.apt_tools_ncurses6 }}"
+                    , DISTRO: "Ubuntu"
+                    , ARTIFACT: "x86_64-linux-ubuntu24.04"
+                    },
+                    { image: "fedora:33"
+                    , installCmd: "dnf install -y"
+                    , toolRequirements: "${{ needs.tool-output.outputs.rpm_tools }}"
+                    , DISTRO: "Fedora"
+                    , ARTIFACT: "x86_64-linux-fedora33"
+                    },
+                    { image: "fedora:36"
+                    , installCmd: "dnf install -y"
+                    , toolRequirements: "${{ needs.tool-output.outputs.rpm_tools }}"
+                    , DISTRO: "Fedora"
+                    , ARTIFACT: "x86_64-linux-fedora36"
+                    },
+                    { image: "fedora:38"
+                    , installCmd: "dnf install -y"
+                    , toolRequirements: "${{ needs.tool-output.outputs.rpm_tools }}"
+                    , DISTRO: "Fedora"
+                    , ARTIFACT: "x86_64-linux-fedora38"
+                    },
+                    { image: "rockylinux:8"
+                    , installCmd: "yum -y install epel-release && yum install -y --allowerasing"
+                    , toolRequirements: "${{ needs.tool-output.outputs.rpm_tools }}"
+                    , DISTRO: "Unknown"
+                    , ARTIFACT: "x86_64-linux-rocky8"
+                    },
+                    { image: "alpine:3.20"
+                    , installCmd: "apk update && apk add"
+                    , toolRequirements: "${{ needs.tool-output.outputs.apk_tools }}"
+                    , DISTRO: "Unknown"
+                    , ARTIFACT: "x86_64-linux-unknown"
+                    },
+                    { image: "alpine:3.12"
+                    , installCmd: "apk update && apk add"
+                    , toolRequirements: "${{ needs.tool-output.outputs.apk_tools }}"
+                    , DISTRO: "Unknown"
+                    , ARTIFACT: "x86_64-linux-alpine312"
+                    },
+                    { image: "alpine:3.20"
+                    , installCmd: "apk update && apk add"
+                    , toolRequirements: "${{ needs.tool-output.outputs.apk_tools }}"
+                    , DISTRO: "Unknown"
+                    , ARTIFACT: "x86_64-linux-alpine320"
+                    }
+                  ]
+    container:
+      image: ${{ matrix.platform.image }}
+    steps:
+      - name: Install requirements
+        shell: sh
+        run: |
+          ${{ matrix.platform.installCmd }} curl bash git ${{ matrix.platform.toolRequirements }}
+
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ matrix.branch }}
+
+      # Test suite uses 'git' to find the test files. That appears
+      # to cause problems in CI. A similar hack is employed in the validate
+      # pipeline.
+      - name: git clone fix
+        run: git config --system --add safe.directory $GITHUB_WORKSPACE
+
+      - name: Install GHCup
+        uses: haskell/ghcup-setup@v1
+        with:
+          cabal: ${{ env.CABAL_VERSION }}
+
+      - uses: ./.github/actions/download
+        with:
+          name: artifacts-${{ matrix.platform.ARTIFACT }}-${{ matrix.branch }}
+          path: ./out
+
+      - name: Run test
+        run: |
+          bash .github/scripts/test.bash
+        env:
+          ARTIFACT: ${{ matrix.platform.ARTIFACT }}
+          DISTRO: ${{ matrix.platform.DISTRO }}
+          ADD_CABAL_ARGS: ${{ matrix.platform.ADD_CABAL_ARGS }}
+
+# TODO: https://github.com/haskell/cabal/issues/11049
+#  test-linux-32bit:
+#    name: Test linux binaries (32bit)
+#    runs-on: ubuntu-latest
+#    needs: ["build-linux-32bit"]
+#    if: $ {{ inputs.test }}
+#    env:
+#      TARBALL_EXT: tar.xz
+#      ARCH: 32
+#      DISTRO: "Unknown"
+#      ARTIFACT: "i386-linux-unknown"
+#      ADD_CABAL_ARGS: ""
+#    strategy:
+#      fail-fast: false
+#      matrix:
+#        branch: ${{ fromJSON(inputs.branches) }}
+#    steps:
+#      - uses: actions/checkout@v4
+#        with:
+#          ref: ${{ matrix.branch }}
+#
+#      - uses: ./.github/actions/download
+#        with:
+#          name: artifacts-${{ env.ARTIFACT }}-${{ matrix.branch }}
+#          path: ./out
+#
+#      - name: Run build (32 bit linux)
+#        uses: docker://i386/alpine:3.20
+#        with:
+#          args: sh -c "apk update && apk add curl bash git ${{ needs.tool-output.outputs.apk_tools }} groff && git config --system --add safe.directory $GITHUB_WORKSPACE && export PATH=$HOME/.ghcup/bin:$PATH && curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org | sh && ghcup install cabal ${{ env.CABAL_VERSION }} && bash .github/scripts/build.bash"
+
+  test-arm:
+    name: Test ARM binary
+    runs-on: ubuntu-22.04-arm
+    needs: ["tool-output", "build-arm"]
+    if: ${{ inputs.test }}
+    env:
+      ADD_CABAL_ARGS: ""
+      TARBALL_EXT: tar.xz
+      ARCH: ARM64
+    strategy:
+      fail-fast: false
+      matrix:
+        branch: ${{ fromJSON(inputs.branches) }}
+        platform: [ { ARCH: "ARM64"
+                    , DISTRO: "Debian"
+                    , ARTIFACT: "aarch64-linux-deb11"
+                    },
+                    { ARCH: "ARM64"
+                    , DISTRO: "Alpine"
+                    , ARTIFACT: "aarch64-linux-unknown"
+                    }
+                  ]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ matrix.branch }}
+
+      - uses: ./.github/actions/download
+        with:
+          name: artifacts-${{ matrix.platform.ARTIFACT }}-${{ matrix.branch }}
+          path: ./out
+
+      - if: matrix.platform.DISTRO == 'Debian'
+        uses: docker://arm64v8/debian:11
+        name: Run build (aarch64 linux)
+        with:
+          args: sh -c "apt-get update && apt-get install -y curl bash git groff-base ${{ needs.tool-output.outputs.apt_tools }} && git config --system --add safe.directory $GITHUB_WORKSPACE && export PATH=$HOME/.ghcup/bin:$PATH && curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org | sh && ghcup install cabal ${{ env.CABAL_VERSION }} && bash .github/scripts/test.bash"
+        env:
+          ARTIFACT: ${{ matrix.platform.ARTIFACT }}
+          DISTRO: ${{ matrix.platform.DISTRO }}
+
+      - if: matrix.platform.DISTRO == 'Alpine'
+        uses: docker://arm64v8/alpine:3.20
+        name: Run build (aarch64 linux alpine)
+        with:
+          args: sh -c "apk update && apk add curl bash git groff ${{ needs.tool-output.outputs.apk_tools }} && git config --system --add safe.directory $GITHUB_WORKSPACE && export PATH=$HOME/.ghcup/bin:$PATH && curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org | sh && ghcup install cabal ${{ env.CABAL_VERSION }} && bash .github/scripts/test.bash"
+        env:
+          ARTIFACT: ${{ matrix.platform.ARTIFACT }}
+          DISTRO: ${{ matrix.platform.DISTRO }}
+
+  test-mac-x86_64:
+    name: Test binary (Mac x86_64)
+    runs-on: macOS-13
+    needs: ["build-mac-x86_64"]
+    if: ${{ inputs.test }}
+    env:
+      ADD_CABAL_ARGS: ""
+      MACOSX_DEPLOYMENT_TARGET: 10.13
+      ARTIFACT: "x86_64-apple-darwin"
+      ARCH: 64
+      TARBALL_EXT: tar.xz
+      DISTRO: na
+    strategy:
+      fail-fast: false
+      matrix:
+        branch: ${{ fromJSON(inputs.branches) }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ matrix.branch }}
+
+      - uses: ./.github/actions/download
+        with:
+          name: artifacts-${{ env.ARTIFACT }}-${{ matrix.branch }}
+          path: ./out
+
+      - name: Install GHCup
+        uses: haskell/ghcup-setup@v1
+        with:
+          cabal: ${{ env.CABAL_VERSION }}
+
+      - name: Run test
+        run: |
+          # cabal-testsuite/PackageTests/Configure/cabal.test.hs needs it
+          # and it doesn't appear pre-installed here
+          brew install autoconf automake
+
+          bash .github/scripts/test.bash
+
+  test-mac-aarch64:
+    name: Test binary (Mac aarch64)
+    runs-on: macos-latest
+    needs: ["build-mac-aarch64"]
+    if: ${{ inputs.test }}
+    env:
+      ADD_CABAL_ARGS: ""
+      MACOSX_DEPLOYMENT_TARGET: 10.13
+      ARTIFACT: "aarch64-apple-darwin"
+      ARCH: ARM64
+      TARBALL_EXT: tar.xz
+      DISTRO: na
+      HOMEBREW_CHANGE_ARCH_TO_ARM: 1
+      GHCUP_INSTALL_BASE_PREFIX: ${{ github.workspace }}
+    strategy:
+      fail-fast: false
+      matrix:
+        branch: ${{ fromJSON(inputs.branches) }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ matrix.branch }}
+
+      - uses: ./.github/actions/download
+        with:
+          name: artifacts-${{ env.ARTIFACT }}-${{ matrix.branch }}
+          path: ./out
+
+      - name: Install GHCup
+        uses: haskell/ghcup-setup@v1
+        with:
+          cabal: ${{ env.CABAL_VERSION }}
+
+      - name: Run test
+        run: |
+          bash .github/scripts/test.bash
+
+  test-win:
+    name: Test binary (Win)
+    runs-on: windows-latest
+    needs: ["build-win"]
+    if: ${{ inputs.test }}
+    env:
+      ADD_CABAL_ARGS: ""
+      ARTIFACT: "x86_64-mingw64"
+      ARCH: 64
+      TARBALL_EXT: "zip"
+      DISTRO: na
+      CABAL_DIR: "C:\\Users\\runneradmin\\AppData\\Roaming\\cabal"
+      GHCUP_INSTALL_BASE_PREFIX: "/c"
+    strategy:
+      fail-fast: false
+      matrix:
+        branch: ${{ fromJSON(inputs.branches) }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ matrix.branch }}
+
+      - name: install windows deps
+        shell: pwsh
+        run: |
+          C:\msys64\usr\bin\bash -lc "pacman --disable-download-timeout --noconfirm -Syuu"
+          C:\msys64\usr\bin\bash -lc "pacman --disable-download-timeout --noconfirm -Syuu"
+          C:\msys64\usr\bin\bash -lc "pacman --disable-download-timeout --noconfirm -S make mingw-w64-x86_64-clang curl autoconf mingw-w64-x86_64-pkgconf ca-certificates base-devel gettext autoconf make libtool automake python p7zip patch unzip zip git"
+          taskkill /F /FI "MODULES eq msys-2.0.dll"
+
+      - uses: ./.github/actions/download
+        with:
+          name: artifacts-${{ env.ARTIFACT }}-${{ matrix.branch }}
+          path: ./out
+
+      - name: Install GHCup
+        uses: haskell/ghcup-setup@v1
+        with:
+          cabal: ${{ env.CABAL_VERSION }}
+
+      - name: Run test (windows)
+        run: |
+          $env:CHERE_INVOKING = 1
+          $env:MSYS2_PATH_TYPE = "inherit"
+          $ErrorActionPreference = "Stop"
+          C:\msys64\usr\bin\bash -lc "bash .github/scripts/test.bash"
+        shell: pwsh
+
+  test-freebsd-x86_64:
+    name: Test FreeBSD x86_64
+    runs-on: [self-hosted, FreeBSD, X64]
+    needs: ["build-freebsd-x86_64"]
+    if: ${{ inputs.test }}
+    env:
+      ADD_CABAL_ARGS: ""
+      ARTIFACT: "x86_64-portbld-freebsd"
+      ARCH: 64
+      TARBALL_EXT: tar.xz
+      DISTRO: na
+      RUNNER_OS: FreeBSD
+      CABAL_DIR: ${{ github.workspace }}/.cabal
+      GHCUP_INSTALL_BASE_PREFIX: ${{ github.workspace }}
+    strategy:
+      fail-fast: false
+      matrix:
+        branch: ${{ fromJSON(inputs.branches) }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ matrix.branch }}
+
+      - uses: ./.github/actions/download
+        with:
+          name: artifacts-${{ env.ARTIFACT }}-${{ matrix.branch }}
+          path: ./out
+
+      - name: Install GHCup
+        uses: haskell/ghcup-setup@v1
+        with:
+          cabal: ${{ env.CABAL_VERSION }}
+
+      - name: Run test
+        run: |
+          sudo sed -i.bak -e 's/quarterly/latest/' /etc/pkg/FreeBSD.conf
+          sudo pkg install -y curl gcc gmp gmake ncurses perl5 pkgconf libffi libiconv git bash misc/compat10x misc/compat11x misc/compat12x groff autoconf automake
+          sudo tzsetup Etc/GMT
+          sudo adjkerntz -a
+          bash .github/scripts/test.bash
+
diff --git a/cabal-install-solver/cabal-install-solver.cabal b/cabal-install-solver/cabal-install-solver.cabal
index 17e9938a46e..a222410efa0 100644
--- a/cabal-install-solver/cabal-install-solver.cabal
+++ b/cabal-install-solver/cabal-install-solver.cabal
@@ -107,7 +107,7 @@ library
     , containers    >=0.5.6.2  && <0.9
     , edit-distance ^>= 0.2.2
     , directory     >= 1.3.7.0  && < 1.4
-    , filepath      ^>=1.4.0.0 || ^>=1.5.0.0
+    , filepath      >= 1.3.0.1  && < 1.6
     , mtl           >=2.0      && <2.4
     , network-uri   >= 2.6.0.2 && < 2.7
     , pretty        ^>=1.1
diff --git a/cabal.release.project b/cabal.release.project
index db9c4f305e2..8fd3d83a188 100644
--- a/cabal.release.project
+++ b/cabal.release.project
@@ -7,7 +7,26 @@ index-state: hackage.haskell.org 2025-06-27T20:43:14Z
 
 -- never include this or its TH dependency in a release!
 package cabal-install
-  flags: -git-rev
+  flags: -git-rev -lukko
 
 package Cabal
   flags: -git-rev
+
+constraints:
+  -- don't use `-march=native` (for portability)
+  hashable -arch-native,
+  -- fixes unicode issues
+  tar >= 0.6.2.0,
+  -- https://github.com/haskell/directory/issues/170
+  directory >= 1.3.8.3,
+  -- avoid deprecated versions
+  filepath == 1.4.101.0 || == 1.4.300.1 || == 1.4.300.2 || == 1.4.301.0 || >= 1.5.2.0
+
+-- https://github.com/haskell/ghcup-hs/issues/1107
+-- https://github.com/haskell/unix/pull/318
+if arch(arm) || arch(i386)
+  constraints: unix >= 2.8.6.0
+
+-- static linking
+package zlib
+  flags: -pkg-config +bundled-c-zlib
diff --git a/scripts/release/create-release-metadata-for-ghcup.sh b/scripts/release/create-release-metadata-for-ghcup.sh
index a74a990b2e6..210afade4be 100755
--- a/scripts/release/create-release-metadata-for-ghcup.sh
+++ b/scripts/release/create-release-metadata-for-ghcup.sh
@@ -1,114 +1,95 @@
-#!/usr/bin/env bash
+#!/bin/sh
 
-# This script, when passed the cabal release number as the first and only argument
-# generates the metadata in the correct format to be usable as is by GHCup
-# for eg:-
-# $ create-release-metadata-for-ghcup.sh 3.10.2.0 or "3.10.2.0"
-
-# Note:- Please run ./download-cabal-install-release-binaries.sh before running this script.
 set -eu
 set -o pipefail
 
 RELEASE=$1
-## FixMe:// What dir to use here?
+VERSION=${RELEASE#cabal-install-v}
+YV=$(echo "$VERSION" | sed 's/\.//g')
+
+cd "gh-release-artifacts/cabal-${VERSION}"
+
+BASE_URL=https://downloads.haskell.org/~cabal/cabal-install-$VERSION
 
-if [ -d "binary-downloads/cabal-install-${RELEASE}-binaries" ]; then
-    echo "binary downloads folder for release ${RELEASE} found, starting generating GHCup metadata..."
-else
-    echo "The binary downloads for release ${RELEASE} not found."
-    echo "Please run the script to download them first."
-fi
+get_sha() {
+    sha256sum "$1" | awk '{ print $1 }'
+}
 
-cd "binary-downloads/cabal-install-${RELEASE}-binaries"
+print_uri_hash() {
+cat <<EOF_INNER > /dev/stdout
+              dlUri: ${BASE_URL}/$1
+              dlHash: $(get_sha "$1")
+EOF_INNER
+}
 
 cat <<EOF > /dev/stdout
-    $RELEASE:
+    $VERSION:
       viTags:
         - Latest
       viChangeLog: https://github.com/haskell/cabal/blob/master/release-notes/cabal-install-$RELEASE.md
       # uncomment viPostInstall if the release needs a post-install message
-      # viPostInstall: &cabal-${RELEASE//./}-post-install |
+      # viPostInstall: &cabal-${YV}-post-install |
       viArch:
         A_64:
-          Linux_UnknownLinux:
-            unknown_versioning: &cabal-${RELEASE//./}-64
-              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$RELEASE/cabal-install-$RELEASE-x86_64-linux-alpine3_12.tar.xz
-              dlHash: $(sha256sum "cabal-install-$RELEASE-x86_64-linux-alpine3_12.tar.xz" | awk '{ print $1 }')
           Linux_Alpine:
-            unknown_versioning: *cabal-${RELEASE//./}-64
-          Linux_CentOS:
-            unknown_versioning: &cabal-${RELEASE//./}-64-centos7
-              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$RELEASE/cabal-install-$RELEASE-x86_64-linux-centos7.tar.xz
-              dlHash: $(sha256sum "cabal-install-$RELEASE-x86_64-linux-centos7.tar.xz" | awk '{ print $1 }')
+            '( >= 3.12 && < 3.20)': &cabal-${YV}-alpine312-64
+$(print_uri_hash "cabal-install-$VERSION-x86_64-linux-alpine312.tar.xz")
+            '>= 3.20':
+$(print_uri_hash "cabal-install-$VERSION-x86_64-linux-alpine320.tar.xz")
+            unknown_versioning: *cabal-${YV}-alpine312-64
+          Linux_UnknownLinux:
+            unknown_versioning:
+$(print_uri_hash "cabal-install-$VERSION-x86_64-linux-unknown.tar.xz")
           Linux_Debian:
-            '( >= 9 && < 10)': &cabal-${RELEASE//./}-64-debian
-              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$RELEASE/cabal-install-$RELEASE-x86_64-linux-deb9.tar.xz
-              dlHash: $(sha256sum "cabal-install-$RELEASE-x86_64-linux-deb9.tar.xz" | awk '{ print $1 }')
-            '( == 10 && < 11)':
-              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$RELEASE/cabal-install-$RELEASE-x86_64-linux-deb10.tar.xz
-              dlHash: $(sha256sum "cabal-install-$RELEASE-x86_64-linux-deb10.tar.xz" | awk '{ print $1 }')
-            '( >= 11)':
-              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$RELEASE/cabal-install-$RELEASE-x86_64-linux-deb11.tar.xz
-              dlHash: $(sha256sum "cabal-install-$RELEASE-x86_64-linux-deb11.tar.xz" | awk '{ print $1 }')
-            unknown_versioning: *cabal-${RELEASE//./}-64-debian
+            '( >= 11 && < 12)': &cabal-${YV}-64-debian11
+$(print_uri_hash "cabal-install-$VERSION-x86_64-linux-deb11.tar.xz")
+            '( >= 12 && < 13)':
+$(print_uri_hash "cabal-install-$VERSION-x86_64-linux-deb12.tar.xz")
+            unknown_versioning: *cabal-${YV}-64-debian11
           Linux_Fedora:
-            '>= 33':
-              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$RELEASE/cabal-install-$RELEASE-x86_64-linux-fedora33.tar.xz
-              dlHash: $(sha256sum "cabal-install-$RELEASE-x86_64-linux-fedora33.tar.xz" | awk '{ print $1 }')
-            unknown_versioning: *cabal-${RELEASE//./}-64-centos7
+            '( >= 33 && < 36 )': &cabal-${YV}-64-fedora33
+$(print_uri_hash "cabal-install-$VERSION-x86_64-linux-fedora33.tar.xz")
+            '( >= 36 && < 38 )':
+$(print_uri_hash "cabal-install-$VERSION-x86_64-linux-fedora36.tar.xz")
+            '>= 38':
+$(print_uri_hash "cabal-install-$VERSION-x86_64-linux-fedora38.tar.xz")
+            unknown_versioning: *cabal-${YV}-64-fedora33
           Linux_Ubuntu:
-            '< 20': &cabal-${RELEASE//./}-64-ubuntu18
-              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$RELEASE/cabal-install-$RELEASE-x86_64-linux-ubuntu18_04.tar.xz
-              dlHash: $(sha256sum "cabal-install-$RELEASE-x86_64-linux-ubuntu18_04.tar.xz" | awk '{ print $1 }')
-            '>= 20': &cabal-${RELEASE//./}-64-ubuntu20
-              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$RELEASE/cabal-install-$RELEASE-x86_64-linux-ubuntu20_04.tar.xz
-              dlHash: $(sha256sum "cabal-install-$RELEASE-x86_64-linux-ubuntu20_04.tar.xz" | awk '{ print $1 }')
-            unknown_versioning: *cabal-${RELEASE//./}-64-ubuntu18
+            '(>= 20 && < 22 )': &cabal-${YV}-64-ubuntu20
+$(print_uri_hash "cabal-install-$VERSION-x86_64-linux-ubuntu20.04.tar.xz")
+            '(>= 22 && < 24 )':
+$(print_uri_hash "cabal-install-$VERSION-x86_64-linux-ubuntu22.04.tar.xz")
+            '(>= 24 && < 26 )':
+$(print_uri_hash "cabal-install-$VERSION-x86_64-linux-ubuntu24.04.tar.xz")
+            unknown_versioning: *cabal-${YV}-64-ubuntu20
           Linux_Mint:
-            '< 20': *cabal-${RELEASE//./}-64-ubuntu18
-            '>= 20': *cabal-${RELEASE//./}-64-ubuntu20
-            unknown_versioning: *cabal-${RELEASE//./}-64-ubuntu18
+            unknown_versioning: *cabal-${YV}-64-ubuntu20
           Darwin:
             unknown_versioning:
-              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$RELEASE/cabal-install-$RELEASE-x86_64-darwin.tar.xz
-              dlHash: $(sha256sum "cabal-install-$RELEASE-x86_64-darwin.tar.xz" | awk '{ print $1 }')
+$(print_uri_hash "cabal-install-$VERSION-x86_64-darwin.tar.xz")
           Windows:
             unknown_versioning:
-              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$RELEASE/cabal-install-$RELEASE-x86_64-windows.zip
-              dlHash: $(sha256sum "cabal-install-$RELEASE-x86_64-windows.zip" | awk '{ print $1 }')
+$(print_uri_hash "cabal-install-$VERSION-x86_64-mingw64.zip")
           FreeBSD:
             unknown_versioning:
-              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$RELEASE/cabal-install-$RELEASE-x86_64-freebsd-14.tar.xz
-              dlHash: $(sha256sum "cabal-install-$RELEASE-x86_64-freebsd-14.tar.xz" | awk '{ print $1 }')
+$(print_uri_hash "cabal-install-$VERSION-x86_64-portbld-freebsd.tar.xz")
         A_32:
           Linux_UnknownLinux:
-            unknown_versioning: &cabal-${RELEASE//./}-32
-              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$RELEASE/cabal-install-$RELEASE-i386-linux-alpine3_12.tar.xz
-              dlHash: $(sha256sum "cabal-install-$RELEASE-i386-linux-alpine3_12.tar.xz" | awk '{ print $1 }')
+            unknown_versioning: &cabal-${YV}-32
+$(print_uri_hash "cabal-install-$VERSION-i386-linux-unknown.tar.xz")
           Linux_Alpine:
-            unknown_versioning: *cabal-${RELEASE//./}-32
-          Linux_Debian:
-            '( >= 9 )':
-              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$RELEASE/cabal-install-$RELEASE-i386-linux-deb9.tar.xz
-              dlHash: $(sha256sum "cabal-install-$RELEASE-i386-linux-deb9.tar.xz" | awk '{ print $1 }')
-            unknown_versioning: *cabal-${RELEASE//./}-32
+            unknown_versioning: *cabal-${YV}-32
         A_ARM64:
           Darwin:
             unknown_versioning:
-              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$RELEASE/cabal-install-$RELEASE-aarch64-darwin.tar.xz
-              dlHash: $(sha256sum "cabal-install-$RELEASE-aarch64-darwin.tar.xz" | awk '{ print $1 }')
+$(print_uri_hash "cabal-install-$VERSION-aarch64-darwin.tar.xz")
           Linux_Debian:
-            '( >= 10 && < 11)': &cabal-${RELEASE//./}-arm64
-              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$RELEASE/cabal-install-$RELEASE-aarch64-linux-deb10.tar.xz
-              dlHash: $(sha256sum "cabal-install-$RELEASE-aarch64-linux-deb10.tar.xz" | awk '{ print $1 }')
-            '( >= 11)':
-              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$RELEASE/cabal-install-$RELEASE-aarch64-linux-deb11.tar.xz
-              dlHash: $(sha256sum "cabal-install-$RELEASE-aarch64-linux-deb11.tar.xz" | awk '{ print $1 }')
-            unknown_versioning: *cabal-${RELEASE//./}-arm64
-          Linux_Alpine:
-            unknown_versioning:
-              dlUri: https://downloads.haskell.org/~cabal/cabal-install-$RELEASE/cabal-install-$RELEASE-aarch64-linux-alpine3_18.tar.xz
-              dlHash: $(sha256sum "cabal-install-$RELEASE-aarch64-linux-alpine3_18.tar.xz" | awk '{ print $1 }')
+            '( >= 11)': &cabal-${YV}-arm64-deb
+$(print_uri_hash "cabal-install-$VERSION-aarch64-linux-deb11.tar.xz")
+            unknown_versioning: *cabal-${YV}-arm64-deb
           Linux_UnknownLinux:
-            unknown_versioning: *cabal-${RELEASE//./}-arm64
+            unknown_versioning: &cabal-${YV}-arm64
+$(print_uri_hash "cabal-install-$VERSION-aarch64-linux-unknown.tar.xz")
+          Linux_Alpine:
+            unknown_versioning: *cabal-${YV}-arm64
 EOF
diff --git a/scripts/release/download-cabal-install-release-binaries.sh b/scripts/release/download-cabal-install-release-binaries.sh
deleted file mode 100755
index f5716ef468e..00000000000
--- a/scripts/release/download-cabal-install-release-binaries.sh
+++ /dev/null
@@ -1,42 +0,0 @@
-#!/usr/bin/env bash
-
-# A script to download the release binary files for a given cabal release
-# from upstream "downloads.haskell.org".
-# It accepts the first and only argument as the release number.
-#
-# usage:-
-#   $ download-cabal-install-release-binaries.sh "3.10.1.0"
-#
-# This was initially made to be used with ./create-release-metadata-for-ghcup.sh
-
-set -eu
-set -o pipefail
-
-RELEASE=$1
-
-echo "RELEASE: $RELEASE"
-
-for com in wget sha256sum ; do
-        command -V ${com} >/dev/null 2>&1
-done
-
-[ ! -d "binary-downloads/cabal-install-${RELEASE}-binaries" ]
-
-mkdir -p "binary-downloads/cabal-install-${RELEASE}-binaries"
-
-cd "binary-downloads/cabal-install-${RELEASE}-binaries"
-
-## Download release files
-echo "Downloading form: \"https://downloads.haskell.org/~cabal/cabal-install-${RELEASE}/\""
-wget --no-parent -r --reject "index.html*" --no-directories "https://downloads.haskell.org/~cabal/cabal-install-${RELEASE}/"
-
-## Verify that sha256 sums of downloaded files match the ones mentioned in the upstream SHA256SUMS file
-echo "verifying checksums for downloaded files..."
-
-if sha256sum --check ./SHA256SUMS; then
-    echo "All checksums match!"
-    echo "Successfully downloaded binaries for release: ${RELEASE}"
-else
-    echo "checksums of downloaded files do no match the ones listed in upstream SHA256SUMS file."
-    echo "please try deleting \"binary-downloads/cabal-install-${RELEASE}-binaries\" folder and downloading again."
-fi
diff --git a/scripts/release/download-gh-artifacts.sh b/scripts/release/download-gh-artifacts.sh
new file mode 100755
index 00000000000..f515c321157
--- /dev/null
+++ b/scripts/release/download-gh-artifacts.sh
@@ -0,0 +1,42 @@
+#!/bin/sh
+
+set -eu
+set -o pipefail
+
+RELEASE=$1
+VERSION=${RELEASE#cabal-install-v}
+SIGNER=$2
+
+echo "RELEASE: $RELEASE"
+echo "SIGNER: $SIGNER"
+
+for com in gh gpg curl sha256sum ; do
+    command -V ${com} >/dev/null 2>&1
+done
+
+[ ! -e "gh-release-artifacts/cabal-${VERSION}" ]
+
+mkdir -p "gh-release-artifacts/cabal-${VERSION}"
+
+git archive --format=tar.gz -o "gh-release-artifacts/cabal-${VERSION}/cabal-${VERSION}-src.tar.gz" --prefix="cabal-${VERSION}/" HEAD
+
+cd "gh-release-artifacts/cabal-${VERSION}"
+
+# github
+gh release download "$RELEASE"
+
+sha256sum ./* > SHA256SUMS
+gpg --detach-sign -u "${SIGNER}" SHA256SUMS
+
+echo
+echo "Now run the following:"
+echo "  ( cd gh-release-artifacts/cabal-${VERSION} && gh release upload $RELEASE cabal-${VERSION}-src.tar.gz SHA256SUMS SHA256SUMS.sig )"
+echo
+echo "And afterwards to upload to downloads.haskell.org:"
+echo "  ./scripts/release/upload-artifacts.sh cabal-install-v${VERSION}"
+echo
+echo "And don't forget to finalize the release at https://github.com/stable-haskell/cabal/releases/tag/cabal-install-v${VERSION}"
+echo
+echo "Also create a PR at https://github.com/haskell/ghcup-metadata/pulls for the vanilla-channel from the output of the following script:"
+echo "  ./scripts/release/create-yaml-snippet.sh cabal-install-v${VERSION}"
+
diff --git a/scripts/release/upload-artifacts.sh b/scripts/release/upload-artifacts.sh
new file mode 100755
index 00000000000..625888e0ea3
--- /dev/null
+++ b/scripts/release/upload-artifacts.sh
@@ -0,0 +1,26 @@
+#!/bin/sh
+
+set -eu
+set -o pipefail
+
+RELEASE=$1
+VERSION=${RELEASE#cabal-install-v}
+URL=https://downloads.haskell.org
+
+cd "gh-release-artifacts/cabal-${VERSION}"
+
+sftp -b - $URL <<EOF
+cd cabal
+
+mkdir cabal-install-$VERSION
+cd cabal-install-$VERSION
+
+put -r .
+
+cd ..
+rm cabal-install-latest
+symlink cabal-install-$VERSION cabal-install-latest
+EOF
+
+curl -X PURGE "https://downloads.haskell.org/~cabal/cabal-install-$VERSION/"
+curl -X PURGE "https://downloads.haskell.org/cabal/cabal-install-$VERSION/"