diff --git a/.github/workflows/binaries-linux-x64-stack.yml b/.github/workflows/binaries-linux-x64-stack.yml
index 7a6df3031..09746b827 100644
--- a/.github/workflows/binaries-linux-x64-stack.yml
+++ b/.github/workflows/binaries-linux-x64-stack.yml
@@ -98,7 +98,7 @@ jobs:
     - name: Install haskell tools with ghcup if needed
       run: |
         if [[ ! -x ~/.ghcup/bin/ghcup ]]; then mkdir -p ~/.ghcup/bin && curl https://downloads.haskell.org/~ghcup/x86_64-linux-ghcup > ~/.ghcup/bin/ghcup && chmod +x ~/.ghcup/bin/ghcup; fi; printf "ghcup: "; ghcup --version
-        if [[ ! -x ~/.ghcup/bin/stack ]]; then ~/.ghcup/bin/ghcup install stack 2.15.5   && ~/.ghcup/bin/ghcup set stack 2.15.5;   fi; printf "stack: "; stack --version
+        if [[ ! -x ~/.ghcup/bin/stack ]]; then ~/.ghcup/bin/ghcup install stack 3.1.1   && ~/.ghcup/bin/ghcup set stack 3.1.1;   fi; printf "stack: "; stack --version
 
     # --allow-different-user is needed because of #863 above (or because stack didn't notice we're in a docker container)
     - name: Install GHC with stack
diff --git a/.github/workflows/binaries-linux-x64.yml b/.github/workflows/binaries-linux-x64.yml
index e7881d307..b060d6d79 100644
--- a/.github/workflows/binaries-linux-x64.yml
+++ b/.github/workflows/binaries-linux-x64.yml
@@ -54,7 +54,7 @@ jobs:
       run: |
         if [[ ! -x ~/.ghcup/bin/ghcup ]];     then mkdir -p ~/.ghcup/bin && curl https://downloads.haskell.org/~ghcup/x86_64-linux-ghcup > ~/.ghcup/bin/ghcup && chmod +x ~/.ghcup/bin/ghcup; fi; printf "ghcup: "; ghcup --version
         if [[ ! -x ~/.ghcup/bin/ghc-9.8.2 ]]; then ~/.ghcup/bin/ghcup install ghc 9.8.2      && ~/.ghcup/bin/ghcup set ghc 9.8.2;      fi; printf "ghc: "; ghc --version
-        if [[ ! -x ~/.ghcup/bin/cabal ]];     then ~/.ghcup/bin/ghcup install cabal 3.10.3.0 && ~/.ghcup/bin/ghcup set cabal 3.10.3.0; fi; printf "cabal: "; cabal --version
+        if [[ ! -x ~/.ghcup/bin/cabal ]];     then ~/.ghcup/bin/ghcup install cabal 3.12.1.0 && ~/.ghcup/bin/ghcup set cabal 3.12.1.0; fi; printf "cabal: "; cabal --version
 
     - name: Update cabal package index
       run: |
diff --git a/.github/workflows/binaries-mac-arm64.yml b/.github/workflows/binaries-mac-arm64.yml
index 8c48a81b6..b3992cdb4 100644
--- a/.github/workflows/binaries-mac-arm64.yml
+++ b/.github/workflows/binaries-mac-arm64.yml
@@ -105,7 +105,7 @@ jobs:
         fi
         ghcup --version
         if [[ ! -x ~/.ghcup/bin/stack ]]; then
-          ~/.ghcup/bin/ghcup install stack 2.15.5 && ~/.ghcup/bin/ghcup set stack 2.15.5
+          ~/.ghcup/bin/ghcup install stack 3.1.1 && ~/.ghcup/bin/ghcup set stack 3.1.1
         fi
         stack --version
 
diff --git a/.github/workflows/binaries-mac-x64.yml b/.github/workflows/binaries-mac-x64.yml
index 52699ad7c..baa15157c 100644
--- a/.github/workflows/binaries-mac-x64.yml
+++ b/.github/workflows/binaries-mac-x64.yml
@@ -98,10 +98,11 @@ jobs:
       run: |
         echo "$HOME/.ghcup/bin/" >> $GITHUB_PATH
 
+    # XXX occasionally we need to force a cache flush, or tools eventually become too old (Cabal tends to break old stack, eg)
     - name: Install haskell tools with ghcup if needed
       run: |
         if [[ ! -x ~/.ghcup/bin/ghcup ]];     then mkdir -p ~/.ghcup/bin && curl https://downloads.haskell.org/~ghcup/x86_64-apple-darwin-ghcup > ~/.ghcup/bin/ghcup && chmod +x ~/.ghcup/bin/ghcup; fi; printf "ghcup: "; ghcup --version
-        if [[ ! -x ~/.ghcup/bin/stack ]];     then ~/.ghcup/bin/ghcup install stack 2.15.5   && ~/.ghcup/bin/ghcup set stack 2.15.5;   fi; printf "stack: "; stack --version
+        if [[ ! -x ~/.ghcup/bin/stack ]];     then ~/.ghcup/bin/ghcup install stack 3.1.1   && ~/.ghcup/bin/ghcup set stack 3.1.1;   fi; printf "stack: "; stack --version
         #if [[ ! -x ~/.ghcup/bin/ghc-9.8.2 ]]; then ~/.ghcup/bin/ghcup install ghc 9.8.2      && ~/.ghcup/bin/ghcup set ghc 9.8.2;     fi; printf "ghc: "; ghc --version
 
     - name: Install GHC with stack