diff --git a/.github/workflows/debian.yml b/.github/workflows/debian.yml
index bf5c967..3f5f06d 100644
--- a/.github/workflows/debian.yml
+++ b/.github/workflows/debian.yml
@@ -26,7 +26,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ghc: ['9.14.1', '9.12.2', '9.10.3', '9.8.4', '9.6.7']
+        ghc: ['9.14.1', '9.12.3', '9.10.3', '9.8.4', '9.6.7']
         deb: ['bullseye', 'slim-bullseye']
         include:
           - ghc: '9.14.1'
@@ -41,7 +41,7 @@ jobs:
           - ghc: '9.14.1'
             ghc_minor: '9.14'
             deb: 'slim-bullseye'
-          - ghc: '9.12.2'
+          - ghc: '9.12.3'
             ghc_minor: '9.12'
             deb: 'bookworm'
           - ghc: '9.12.2'
@@ -85,7 +85,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ghc: ['9.6.7', '9.8.4', '9.10.3', '9.12.2', '9.14.1']
+        ghc: ['9.6.7', '9.8.4', '9.10.3', '9.12.3', '9.14.1']
         # native arm runner; still avoid slim variants here
         deb: ['bullseye']
         include:
diff --git a/9.12/bookworm.yaml b/9.12/bookworm.yaml
index b778dde..9daa0a5 100644
--- a/9.12/bookworm.yaml
+++ b/9.12/bookworm.yaml
@@ -4,11 +4,11 @@ distro:
   abbr: 'deb12'
   image: 'debian:bookworm'
 ghc:
-  version: "9.12.2"
+  version: "9.12.3"
   release_key: "FFEB7CE81E16A36B3E2DED6F2DE04D4E97DB64AD"
   sha256sum:
-    "aarch64": 'bee95bc91a621d8a2e9a9d86dac28ff839605e87316518dae12c779709bd58f1'
-    "x86_64": '447ec2fcc773ae9ebc3f39766c719641631274f9b765d7426a8cbe9241677c9f'
+    "aarch64": '2b7f65ad98b5c6026e52d4af5ab7c06496280fb522bf36d02d08d1078c9d306e'
+    "x86_64": '0901bc97e5de9bd32bf65eaa8d3c30a06792d70a899e8e7040a85216f58772741'
 cabal_install:
   sha256sum:
     "aarch64": 'f763fb2af2bc1ff174b7361a7d51109a585954f87a0e14f86d144f3bce28f7a9'
diff --git a/9.12/bookworm/Dockerfile b/9.12/bookworm/Dockerfile
index be07587..0839d5d 100644
--- a/9.12/bookworm/Dockerfile
+++ b/9.12/bookworm/Dockerfile
@@ -96,7 +96,7 @@ RUN set -eux; \
     \
     cabal --version
 
-ARG GHC='9.12.2'
+ARG GHC='9.12.3'
 ARG GHC_RELEASE_KEY='FFEB7CE81E16A36B3E2DED6F2DE04D4E97DB64AD'
 
 RUN set -eux; \
@@ -106,10 +106,10 @@ RUN set -eux; \
     # sha256 from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS \
     case "$ARCH" in \
         'aarch64') \
-            GHC_SHA256='bee95bc91a621d8a2e9a9d86dac28ff839605e87316518dae12c779709bd58f1'; \
+            GHC_SHA256='2b7f65ad98b5c6026e52d4af5ab7c06496280fb522bf36d02d08d1078c9d306e'; \
             ;; \
         'x86_64') \
-            GHC_SHA256='447ec2fcc773ae9ebc3f39766c719641631274f9b765d7426a8cbe9241677c9f'; \
+            GHC_SHA256='0901bc97e5de9bd32bf65eaa8d3c30a06792d70a899e8e7040a85216f58772741'; \
             ;; \
         *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
     esac; \
diff --git a/9.12/bullseye.yaml b/9.12/bullseye.yaml
index 72ec334..b5732bb 100644
--- a/9.12/bullseye.yaml
+++ b/9.12/bullseye.yaml
@@ -4,11 +4,11 @@ distro:
   abbr: 'deb11'
   image: 'debian:bullseye'
 ghc:
-  version: "9.12.2"
+  version: "9.12.3"
   release_key: "FFEB7CE81E16A36B3E2DED6F2DE04D4E97DB64AD"
   sha256sum:
-    "aarch64": '6048eae62ede069459398fa6f2e92ab9719e1b83e93a9014e6a410c54ed2755f' # hash from deb10 bindist
-    "x86_64": '47d5faba492545b49b8dd49a79e64b4ef8eb4b1632d4ddc64355ce4e812eec75'
+    "aarch64": '1946fd6587dcf0a5f37f0751144b7f5994301949595c17eaf1e1056adff73ce5' # hash from deb10 bindist
+    "x86_64": '0bc7fa1b48efe4dc40f92ad5ae3e6fc132c7918efd06d611df286adc4e5a5d31'
 cabal_install:
   sha256sum:
     "aarch64": '5e8c47a055d5b744741039a7061ee43ec7d080d1251784e7a4cd836403e42523'
@@ -17,6 +17,6 @@ overrides:
   ghc:
     "aarch64":
       # GHC 9.12.2 doesn't have a deb11 bindist for aarch64 for some reason, so we're using the deb10 one instead
-      url: "https://downloads.haskell.org/~ghc/9.12.2/ghc-9.12.2-aarch64-deb10-linux.tar.xz"
+      url: "https://downloads.haskell.org/~ghc/9.12.3/ghc-9.12.3-aarch64-deb10-linux.tar.xz"
 _globals: !include '_globals.yaml'
 
diff --git a/9.12/bullseye/Dockerfile b/9.12/bullseye/Dockerfile
index ba9b8a3..1cc59f4 100644
--- a/9.12/bullseye/Dockerfile
+++ b/9.12/bullseye/Dockerfile
@@ -96,7 +96,7 @@ RUN set -eux; \
     \
     cabal --version
 
-ARG GHC='9.12.2'
+ARG GHC='9.12.3'
 ARG GHC_RELEASE_KEY='FFEB7CE81E16A36B3E2DED6F2DE04D4E97DB64AD'
 
 RUN set -eux; \
@@ -106,11 +106,11 @@ RUN set -eux; \
     # sha256 from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS \
     case "$ARCH" in \
         'aarch64') \
-            GHC_SHA256='6048eae62ede069459398fa6f2e92ab9719e1b83e93a9014e6a410c54ed2755f'; \
-            GHC_URL='https://downloads.haskell.org/~ghc/9.12.2/ghc-9.12.2-aarch64-deb10-linux.tar.xz'; \
+            GHC_SHA256='1946fd6587dcf0a5f37f0751144b7f5994301949595c17eaf1e1056adff73ce5'; \
+            GHC_URL='https://downloads.haskell.org/~ghc/9.12.3/ghc-9.12.3-aarch64-deb10-linux.tar.xz'; \
             ;; \
         'x86_64') \
-            GHC_SHA256='47d5faba492545b49b8dd49a79e64b4ef8eb4b1632d4ddc64355ce4e812eec75'; \
+            GHC_SHA256='0bc7fa1b48efe4dc40f92ad5ae3e6fc132c7918efd06d611df286adc4e5a5d31'; \
             ;; \
         *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
     esac; \
diff --git a/9.12/slim-bookworm.yaml b/9.12/slim-bookworm.yaml
index 257b055..b2f3a4a 100644
--- a/9.12/slim-bookworm.yaml
+++ b/9.12/slim-bookworm.yaml
@@ -4,11 +4,11 @@ distro:
   abbr: 'deb12'
   image: 'debian:bookworm-slim'
 ghc:
-  version: "9.12.2"
+  version: "9.12.3"
   release_key: "FFEB7CE81E16A36B3E2DED6F2DE04D4E97DB64AD"
   sha256sum:
-    "aarch64": 'bee95bc91a621d8a2e9a9d86dac28ff839605e87316518dae12c779709bd58f1'
-    "x86_64": '447ec2fcc773ae9ebc3f39766c719641631274f9b765d7426a8cbe9241677c9f'
+    "aarch64": '2b7f65ad98b5c6026e52d4af5ab7c06496280fb522bf36d02d08d1078c9d306e'
+    "x86_64": '0901bc97e5de9bd32bf65eaa8d3c30a06792d70a899e8e7040a85216f58772741'
 cabal_install:
   sha256sum:
     "aarch64": 'f763fb2af2bc1ff174b7361a7d51109a585954f87a0e14f86d144f3bce28f7a9'
diff --git a/9.12/slim-bookworm/Dockerfile b/9.12/slim-bookworm/Dockerfile
index 98e457a..26ad6da 100644
--- a/9.12/slim-bookworm/Dockerfile
+++ b/9.12/slim-bookworm/Dockerfile
@@ -96,7 +96,7 @@ RUN set -eux; \
     \
     cabal --version
 
-ARG GHC='9.12.2'
+ARG GHC='9.12.3'
 ARG GHC_RELEASE_KEY='FFEB7CE81E16A36B3E2DED6F2DE04D4E97DB64AD'
 
 RUN set -eux; \
@@ -106,10 +106,10 @@ RUN set -eux; \
     # sha256 from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS \
     case "$ARCH" in \
         'aarch64') \
-            GHC_SHA256='bee95bc91a621d8a2e9a9d86dac28ff839605e87316518dae12c779709bd58f1'; \
+            GHC_SHA256='2b7f65ad98b5c6026e52d4af5ab7c06496280fb522bf36d02d08d1078c9d306e'; \
             ;; \
         'x86_64') \
-            GHC_SHA256='447ec2fcc773ae9ebc3f39766c719641631274f9b765d7426a8cbe9241677c9f'; \
+            GHC_SHA256='0901bc97e5de9bd32bf65eaa8d3c30a06792d70a899e8e7040a85216f58772741'; \
             ;; \
         *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
     esac; \
diff --git a/9.12/slim-bullseye.yaml b/9.12/slim-bullseye.yaml
index f148694..bb4a443 100644
--- a/9.12/slim-bullseye.yaml
+++ b/9.12/slim-bullseye.yaml
@@ -4,11 +4,11 @@ distro:
   abbr: 'deb11'
   image: 'debian:bullseye-slim'
 ghc:
-  version: "9.12.2"
+  version: "9.12.3"
   release_key: "FFEB7CE81E16A36B3E2DED6F2DE04D4E97DB64AD"
   sha256sum:
-    "aarch64": '6048eae62ede069459398fa6f2e92ab9719e1b83e93a9014e6a410c54ed2755f' # hash from deb10 bindist
-    "x86_64": '47d5faba492545b49b8dd49a79e64b4ef8eb4b1632d4ddc64355ce4e812eec75'
+    "aarch64": '1946fd6587dcf0a5f37f0751144b7f5994301949595c17eaf1e1056adff73ce5' # hash from deb10 bindist
+    "x86_64": '0bc7fa1b48efe4dc40f92ad5ae3e6fc132c7918efd06d611df286adc4e5a5d31'
 cabal_install:
   sha256sum:
     "aarch64": '5e8c47a055d5b744741039a7061ee43ec7d080d1251784e7a4cd836403e42523'
@@ -17,6 +17,6 @@ overrides:
   ghc:
     "aarch64":
       # GHC 9.12.2 doesn't have a deb11 bindist for aarch64 for some reason, so we're using the deb10 one instead
-      url: "https://downloads.haskell.org/~ghc/9.12.2/ghc-9.12.2-aarch64-deb10-linux.tar.xz"
+      url: "https://downloads.haskell.org/~ghc/9.12.3/ghc-9.12.3-aarch64-deb10-linux.tar.xz"
 _globals: !include '_globals.yaml'
 
diff --git a/9.12/slim-bullseye/Dockerfile b/9.12/slim-bullseye/Dockerfile
index 205a0fb..e38dbd2 100644
--- a/9.12/slim-bullseye/Dockerfile
+++ b/9.12/slim-bullseye/Dockerfile
@@ -96,7 +96,7 @@ RUN set -eux; \
     \
     cabal --version
 
-ARG GHC='9.12.2'
+ARG GHC='9.12.3'
 ARG GHC_RELEASE_KEY='FFEB7CE81E16A36B3E2DED6F2DE04D4E97DB64AD'
 
 RUN set -eux; \
@@ -106,11 +106,11 @@ RUN set -eux; \
     # sha256 from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS \
     case "$ARCH" in \
         'aarch64') \
-            GHC_SHA256='6048eae62ede069459398fa6f2e92ab9719e1b83e93a9014e6a410c54ed2755f'; \
-            GHC_URL='https://downloads.haskell.org/~ghc/9.12.2/ghc-9.12.2-aarch64-deb10-linux.tar.xz'; \
+            GHC_SHA256='1946fd6587dcf0a5f37f0751144b7f5994301949595c17eaf1e1056adff73ce5'; \
+            GHC_URL='https://downloads.haskell.org/~ghc/9.12.3/ghc-9.12.3-aarch64-deb10-linux.tar.xz'; \
             ;; \
         'x86_64') \
-            GHC_SHA256='47d5faba492545b49b8dd49a79e64b4ef8eb4b1632d4ddc64355ce4e812eec75'; \
+            GHC_SHA256='0bc7fa1b48efe4dc40f92ad5ae3e6fc132c7918efd06d611df286adc4e5a5d31'; \
             ;; \
         *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
     esac; \