diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 70bb0c8a6dd..abf19bffab8 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -32,10 +32,10 @@ on:
 env:
   # We choose a stable ghc version across all os's
   # which will be used to do the next release
-  GHC_FOR_RELEASE: "9.4.8"
+  GHC_FOR_RELEASE: "9.10.2"
   # Ideally we should use the version about to be released for hackage tests and benchmarks
-  GHC_FOR_SOLVER_BENCHMARKS: "9.4.8"
-  GHC_FOR_COMPLETE_HACKAGE_TESTS: "9.4.8"
+  GHC_FOR_SOLVER_BENCHMARKS: "9.10.2"
+  GHC_FOR_COMPLETE_HACKAGE_TESTS: "9.10.2"
   COMMON_FLAGS: "-j 2 -v"
 
   # See https://github.com/haskell/cabal/blob/master/CONTRIBUTING.md#hackage-revisions
@@ -61,7 +61,7 @@ jobs:
         ghc:
           [
             "9.12.2",
-            "9.10.1",
+            "9.10.2",
             "9.8.4",
             "9.6.7",
             "9.4.8",
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 87b6d0de22a..4657457baad 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -3,10 +3,10 @@ stages:
 
 variables:
   # Commit of ghc/ci-images repository from which to pull Docker images
-  DOCKER_REV: "a9297a370025101b479cfd4977f8f910814e03ab"
+  DOCKER_REV: "df20b2eb2fcc1c93aed5ad047c65752fbd4c38d4"
 
-  GHC_VERSION: 9.6.4
-  CABAL_INSTALL_VERSION: 3.10.2.0
+  GHC_VERSION: 9.10.2
+  CABAL_INSTALL_VERSION: 3.14.2.0
 
 workflow:
   rules:
@@ -33,12 +33,10 @@ linux:
       - ARCH: i386
         TAG: x86_64-linux
         OS:
-          - deb9
           - deb10
       - ARCH: x86_64
         TAG: x86_64-linux
         OS:
-          - deb9
           - deb10
           - deb11
           - deb12
@@ -46,17 +44,9 @@ linux:
           - fedora36
           - fedora38
           - rocky8
-          - ubuntu18_04
           - ubuntu20_04
           - ubuntu22_04
-      # Pull this one from the future, since it's missing.
-      # We can't move the entire file to this DOCKER_REV, because
-      # i386-linux-deb9 is missing from it.
-      - ARCH: x86_64
-        TAG: x86_64-linux
-        OS: centos7
-        DOCKER_REV: f2d12519f45a13a61fcca03a949f927ceead6492
-
+          - ubuntu24_04
       - ARCH: aarch64
         TAG: aarch64-linux
         OS:
@@ -76,12 +66,11 @@ alpine-linux:
   extends: .build
   parallel:
     matrix:
-      - ARCH: [i386, x86_64]
-        OS: [alpine3_12, alpine3_15, alpine3_17]
+      - ARCH: [x86_64]
+        OS: [alpine3_12, alpine3_20]
         TAG: x86_64-linux
-      # Was 3_18 for i386 intentionally left off?
-      - ARCH: x86_64
-        OS: alpine3_18
+      - ARCH: [i386]
+        OS: alpine3_20
         TAG: x86_64-linux
       - ARCH: [aarch64]
         OS: [alpine3_18]
@@ -110,9 +99,6 @@ darwin:
   tags:
     - ${ARCH}-darwin-m1
   variables:
-    # Using 9.8.2 to work around
-    # https://gitlab.haskell.org/ghc/ghc/-/issues/24050
-    GHC_VERSION: 9.8.2
     TARBALL_ARCHIVE_SUFFIX: ${ARCH}-darwin
     TARBALL_EXT: tar.xz
     ADD_CABAL_ARGS: ""
diff --git a/.gitlab/ci.sh b/.gitlab/ci.sh
index 94abd39cdf9..708ff0e0d30 100755
--- a/.gitlab/ci.sh
+++ b/.gitlab/ci.sh
@@ -4,20 +4,70 @@ set -Eeuo pipefail
 
 source "$CI_PROJECT_DIR/.gitlab/common.sh"
 
-## Figure out how to get the Haskell toolchain.
-
-# For backport, the centos image no longer has the right GHC version, so use
-# ghcup.
-if [[ -f /etc/os-release && "$(grep ^ID /etc/os-release)" =~ "centos" ]]; then
-    . "$CI_PROJECT_DIR/.gitlab/ghcup.sh"
-# All the other ones are fine.
-elif [[ "$(uname)" == "Linux" ]]; then
-    export PATH="/opt/ghc/${GHC_VERSION}/bin:${PATH}"
-# Not all runners use ci-images, so ghcup is used.
+# Required arguments to the script
+: "${GHC_VERSION:?Need to set GHC_VERSION}"
+: "${CABAL_INSTALL_VERSION:?Need to set CABAL_INSTALL_VERSION}"
+
+# If GHC is set, extract its directory and add it to PATH
+# The linux images set the GHC variable to specify the location of the GHC installation.
+if [[ -n "${GHC:-}" ]]; then
+  echo "GHC variable is set to: $GHC"
+  export PATH="$(dirname "$GHC"):$PATH"
+else
+  GHC="ghc"
+fi
+
+echo "Checking toolchain versions..."
+
+# GHC check
+ghc_version_ok=false
+if command -v ghc  &>/dev/null; then
+  current_ghc_version=$(ghc --numeric-version)
+  if [[ "$current_ghc_version" == "$GHC_VERSION" ]]; then
+    ghc_version_ok=true
+  else
+    echo "Wrong GHC version: found $current_ghc_version, expected $GHC_VERSION"
+  fi
 else
-    . "$CI_PROJECT_DIR/.gitlab/ghcup.sh"
+  echo "GHC executable '$GHC' not found on PATH"
 fi
 
+# cabal check
+cabal_version_ok=false
+if command -v cabal &>/dev/null; then
+  current_cabal_version=$(cabal --numeric-version)
+  if [[ "$current_cabal_version" == "$CABAL_INSTALL_VERSION" ]]; then
+    cabal_version_ok=true
+  else
+    echo "Wrong cabal version: found $current_cabal_version, expected $CABAL_INSTALL_VERSION"
+  fi
+else
+  echo "cabal not found on PATH"
+fi
+
+# If either is wrong, install via ghcup
+if ! $ghc_version_ok || ! $cabal_version_ok; then
+  echo "Installing correct GHC and/or cabal via ghcup..."
+  . "$CI_PROJECT_DIR/.gitlab/ghcup.sh"
+fi
+
+# Final verification (ghc and cabal must now be on PATH)
+echo "Verifying installed versions..."
+
+actual_ghc_version=$(ghc --numeric-version)
+actual_cabal_version=$(cabal --numeric-version)
+
+if [[ "$actual_ghc_version" != "$GHC_VERSION" ]]; then
+  fail "Incorrect GHC version (actual: $actual_ghc_version, expected: $GHC_VERSION)"
+fi
+
+if [[ "$actual_cabal_version" != "$CABAL_INSTALL_VERSION" ]]; then
+  fail "Incorrect cabal version (actual: $actual_cabal_version, expected: $CABAL_INSTALL_VERSION)"
+fi
+
+echo "Using GHC version: $actual_ghc_version"
+echo "Using cabal-install version: $actual_cabal_version"
+
 export CABAL_DIR="$CI_PROJECT_DIR/cabal"
 
 case "$(uname)" in