diff --git a/.github/workflows/binaries-linux-arm64.yml b/.github/workflows/binaries-linux-arm64.yml
new file mode 100644
index 000000000..b4697c000
--- /dev/null
+++ b/.github/workflows/binaries-linux-arm64.yml
@@ -0,0 +1,139 @@
+# TRIGGER: Runs on any push to binaries-linux-arm64 or binaries branches.
+# ACTION: Builds, unit-tests and saves linux arm64 static binaries with cabal and the ghc version below and Alpine linux,
+# which provides the statically-linkable musl.
+
+name: binaries-linux-arm64
+on:
+  push:
+    branches: [ binaries-linux-arm64, binaries ]
+  workflow_dispatch:
+jobs:
+  build:
+    runs-on:   ubuntu-24.04-arm
+    # container: arm64v8/alpine:3.18
+    # work around janky arm/alpine support
+    # https://github.com/actions/runner/issues/801#issuecomment-2394425757
+    container:
+      image: arm64v8/alpine:3.18
+      volumes:
+        - /:/host  # Jailbreak!
+
+    steps:
+
+    - name: Patch native Alpine NodeJS into Runner environment
+      if: runner.os == 'Linux'
+      run: |
+        apk add nodejs
+        sed -i "s:ID=alpine:ID=NotpineForGHA:" /etc/os-release
+        cd /host/home/runner/runners/*/externals/
+        rm -rf node20/*
+        mkdir node20/bin
+        ln -s /usr/bin/node node20/bin/node
+      shell: sh  # No bash in Alpine by default
+    # doesn't work. Other possible workarounds:
+    # https://github.com/userdocs/test/actions/runs/12828579208/workflow
+    # https://github.com/foxcpp/maddy/pull/758/files
+
+    - name: Check out
+      uses: actions/checkout@v4
+      # have to fetch everything for git describe for --version
+      with:
+        fetch-depth: 0  
+
+    # things to be cached/restored:
+
+    - name: process cache of ghcup-installed tools
+      id:   ghcup
+      uses: actions/cache@v4
+      with:
+        path: ~/.ghcup
+        key: ${{ runner.os }}-ghcup-${{ hashFiles('**.yaml') }}
+        restore-keys: |
+             ${{ runner.os }}-ghcup
+
+    - name: process cache of cabal-installed libs
+      id:   cabal
+      uses: actions/cache@v4
+      with:
+        path: ~/.cabal
+        key: ${{ runner.os }}-cabal-${{ hashFiles('**.yaml') }}
+        restore-keys: |
+             ${{ runner.os }}-cabal
+
+    # actions:
+
+    - name: Install general tools with system package manager
+      run: |
+        apk --no-cache add binutils-gold curl gcc g++ git tar gmp-dev libffi-dev ncurses-dev ncurses-static zlib-dev zlib-static
+
+    - name: Add .ghcup/bin to PATH
+      run: |
+        echo "$HOME/.ghcup/bin/" >> $GITHUB_PATH
+
+    - name: Install haskell ghcup if needed
+      uses: haskell/ghcup-setup@v1
+      # with:
+      #   config: |
+      #     arch: "A_64"
+      #     platform: { "contents": "Alpine", "tag": "Linux" }
+      #     version: "3.18"
+
+    - name: Install haskell tools with ghcup if needed
+      run: |
+        # Try hard to persuade ghcup to install an aarch64 binary
+        #ghcup config set platform-override '{ "arch": "A_64", "platform": { "contents": "Alpine", "tag": "Linux" }, "version": "3.18" }'
+        # cat >~/.ghcup/config.yaml <<END
+        # platform-override:
+        #   arch: A_64
+        #   platform:
+        #     contents: Alpine
+        #     tag: Linux
+        #   version: '3.18'
+        # END
+        # if [[ ! -x ~/.ghcup/bin/ghc-9.12.2 ]]; then ~/.ghcup/bin/ghcup install ghc 9.12.2 -u https://downloads.haskell.org/~ghc/9.12.2/ghc-9.12.2-aarch64-alpine3_18-linux.tar.xz && ~/.ghcup/bin/ghcup set ghc 9.12.2;     fi; printf "ghc: ";   ghc   --version
+
+        if [[ ! -x ~/.ghcup/bin/ghc-9.12.2 ]]; then ~/.ghcup/bin/ghcup install ghc   9.12.2   && ~/.ghcup/bin/ghcup set ghc   9.12.2;   fi; printf "ghc: ";   ghc   --version
+        if [[ ! -x ~/.ghcup/bin/cabal ]];      then ~/.ghcup/bin/ghcup install cabal 3.14.2.0 && ~/.ghcup/bin/ghcup set cabal 3.14.2.0; fi; printf "cabal: "; cabal --version
+
+    - name: Display GHCup logs on error
+      if: failure()
+      run: |
+        echo "GHCup installation failed. Displaying logs:"
+        cat ~/.ghcup/logs/*.log
+    
+    - name: Update cabal package index
+      run: |
+        cabal update
+
+    - name: Build with cabal
+      run: |
+        cabal build --enable-executable-static --ghc-options=-Werror hledger     || (echo "ERROR: building hledger failed"; false)
+        cabal build --enable-executable-static --ghc-options=-Werror hledger-ui  || (echo "ERROR: building hledger-ui failed"; false)
+        cabal build --enable-executable-static --ghc-options=-Werror hledger-web || (echo "ERROR: building hledger-web failed"; false)
+
+    - name: Gather binaries
+      run: |
+        mkdir tmp
+        cp dist-newstyle/build/aarch64-linux/ghc-*/hledger-*/x/hledger/build/hledger/hledger tmp
+        cp dist-newstyle/build/aarch64-linux/ghc-*/hledger-ui-*/x/hledger-ui/build/hledger-ui/hledger-ui tmp
+        cp dist-newstyle/build/aarch64-linux/ghc-*/hledger-web-*/x/hledger-web/build/hledger-web/hledger-web tmp
+        cp hledger/embeddedfiles/*.1 tmp
+        cp hledger/embeddedfiles/*.info tmp
+        cp hledger/shell-completion/hledger-completion.bash tmp
+        strip tmp/hledger
+        strip tmp/hledger-ui
+        strip tmp/hledger-web
+        cd tmp
+        tar cvf hledger-linux-arm64.tar hledger hledger-ui hledger-web *.1 *.info hledger-completion.bash
+        ./hledger --version
+        ./hledger-ui --version
+        ./hledger-web --version
+
+    # upload-artifact loses execute permissions, so we tar the binaries to preserve them.
+    # github UI always zips artifacts when they are downloaded, so we don't bother compressing the tar.
+    # Unfortunately it means users must both unzip and untar.
+    - name: Upload binaries
+      uses: actions/upload-artifact@v4
+      with:
+        name: hledger-linux-arm64
+        path: tmp/hledger-linux-arm64.tar