diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 29dc71b..79db96a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,10 +13,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ghc: ['8.10.4', '9.0.1']
+        ghc: ['8.10.7', '9.0.1']
         deb: ['stretch', 'buster']
         include:
-          - ghc: '8.10.4'
+          - ghc: '8.10.7'
             ghc_minor: '8.10'
           - ghc: '9.0.1'
             ghc_minor: '9.0'
diff --git a/8.10/buster/Dockerfile b/8.10/buster/Dockerfile
index ddf001a..31b6ea2 100644
--- a/8.10/buster/Dockerfile
+++ b/8.10/buster/Dockerfile
@@ -1,15 +1,56 @@
+FROM debian:buster AS builder
+
+ENV LANG C.UTF-8
+
+# to install ghcup + ghc, cabal and stack
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        build-essential \
+        ca-certificates \
+        curl \
+        libffi-dev \
+        libffi6 \
+        libgmp-dev \
+        libgmp10 \
+        libncurses-dev \
+        libncurses5 \
+        libtinfo5 && \
+    rm -rf /var/lib/apt/lists/*
+
+# install ghcup
+ARG GHCUP_VERSION=0.1.16.2
+RUN curl --proto '=https' --tlsv1.2 -sSf https://downloads.haskell.org/~ghcup/$GHCUP_VERSION/x86_64-linux-ghcup-$GHCUP_VERSION > /usr/bin/ghcup && \
+    chmod +x /usr/bin/ghcup
+
+# install cabal
+ARG CABAL_VERSION=3.4.0.0
+RUN ghcup install cabal -i /usr/local/bin $CABAL_VERSION
+
+# install stack
+ARG STACK_VERSION=2.7.3
+RUN ghcup install stack -i /usr/local/bin $STACK_VERSION
+
+# install GHC into /opt/ghc + remove profiling support
+ARG GHC_VERSION=8.10.7
+RUN ghcup install ghc -i /opt/ghc $GHC_VERSION && \
+  find /opt/ghc/lib -name "*.p_hi" -type f -delete && \
+  find /opt/ghc/lib -name "*_p.a" -type f -delete
+
 FROM debian:buster
 
 ENV LANG C.UTF-8
 
+# common haskell + stack dependencies
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
-        dirmngr \
-        g++ \
         git \
-        gnupg \
+        gcc \
+        g++ \
+        libc6-dev \
+        libffi-dev \
+        libgmp-dev \
         libsqlite3-dev \
         libtinfo-dev \
         make \
@@ -19,36 +60,18 @@ RUN apt-get update && \
         zlib1g-dev && \
     rm -rf /var/lib/apt/lists/*
 
-ARG GHC=8.10.4
-ARG DEBIAN_KEY=427CB69AAC9D00F2A43CAF1CBA3CBA3FFE22B574
-ARG CABAL_INSTALL=3.4
+COPY --from=builder /usr/local/bin /usr/local/bin
+COPY --from=builder /opt/ghc/bin /opt/ghc/bin
+COPY --from=builder /opt/ghc/lib /opt/ghc/lib
 
-RUN export GNUPGHOME="$(mktemp -d)" && \
-    gpg --batch --keyserver keyserver.ubuntu.com --recv-keys ${DEBIAN_KEY} && \
-    gpg --batch --armor --export ${DEBIAN_KEY} > /etc/apt/trusted.gpg.d/haskell.org.gpg.asc && \
-    gpgconf --kill all && \
-    echo 'deb http://downloads.haskell.org/debian buster main' > /etc/apt/sources.list.d/ghc.list && \
-    apt-get update && \
-    apt-get install -y --no-install-recommends \
-        cabal-install-${CABAL_INSTALL} \
-        ghc-${GHC} && \
-    rm -rf "$GNUPGHOME" /var/lib/apt/lists/*
-
-ARG STACK=2.7.3
-ARG STACK_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
-ARG STACK_RELEASE_KEY=2C6A674E85EE3FB896AFC9B965101FF31C5C154D
-
-RUN export GNUPGHOME="$(mktemp -d)" && \
-    gpg --batch --keyserver keyserver.ubuntu.com --recv-keys ${STACK_KEY} && \
-    gpg --batch --keyserver keyserver.ubuntu.com --recv-keys ${STACK_RELEASE_KEY} && \
-    curl -fSL https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-x86_64.tar.gz -o stack.tar.gz && \
-    curl -fSL https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-x86_64.tar.gz.asc -o stack.tar.gz.asc && \
-    gpg --batch --trusted-key 0x575159689BEFB442 --verify stack.tar.gz.asc stack.tar.gz && \
-    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 && \
-    /usr/local/bin/stack config set system-ghc --global true && \
-    /usr/local/bin/stack config set install-ghc --global false && \
-    rm -rf "$GNUPGHOME" /var/lib/apt/lists/* /stack.tar.gz.asc /stack.tar.gz
-
-ENV PATH /root/.cabal/bin:/root/.local/bin:/opt/cabal/${CABAL_INSTALL}/bin:/opt/ghc/${GHC}/bin:$PATH
+# stack should use global ghc
+RUN /usr/local/bin/stack config set system-ghc --global true && \
+    /usr/local/bin/stack config set install-ghc --global false
+
+# ensure any user gets GHC on the path
+RUN echo 'export PATH="/opt/ghc/bin:$PATH"' >> /etc/profile.d/ghc_path.sh && \
+	chmod +x /etc/profile.d/ghc_path.sh
+
+ENV PATH /root/.cabal/bin:/root/.local/bin:/opt/ghc/bin:$PATH
 
 CMD ["ghci"]
diff --git a/8.10/stretch/Dockerfile b/8.10/stretch/Dockerfile
index 37a7d7b..f85f0ba 100644
--- a/8.10/stretch/Dockerfile
+++ b/8.10/stretch/Dockerfile
@@ -1,15 +1,56 @@
+FROM debian:stretch AS builder
+
+ENV LANG C.UTF-8
+
+# to install ghcup + ghc, cabal and stack
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        build-essential \
+        ca-certificates \
+        curl \
+        libffi-dev \
+        libffi6 \
+        libgmp-dev \
+        libgmp10 \
+        libncurses-dev \
+        libncurses5 \
+        libtinfo5 && \
+    rm -rf /var/lib/apt/lists/*
+
+# install ghcup
+ARG GHCUP_VERSION=0.1.16.2
+RUN curl --proto '=https' --tlsv1.2 -sSf https://downloads.haskell.org/~ghcup/$GHCUP_VERSION/x86_64-linux-ghcup-$GHCUP_VERSION > /usr/bin/ghcup && \
+    chmod +x /usr/bin/ghcup
+
+# install cabal
+ARG CABAL_VERSION=3.4.0.0
+RUN ghcup install cabal -i /usr/local/bin $CABAL_VERSION
+
+# install stack
+ARG STACK_VERSION=2.7.3
+RUN ghcup install stack -i /usr/local/bin $STACK_VERSION
+
+# install GHC into /opt/ghc + remove profiling support
+ARG GHC_VERSION=8.10.7
+RUN ghcup install ghc -i /opt/ghc $GHC_VERSION && \
+  find /opt/ghc/lib -name "*.p_hi" -type f -delete && \
+  find /opt/ghc/lib -name "*_p.a" -type f -delete
+
 FROM debian:stretch
 
 ENV LANG C.UTF-8
 
+# common haskell + stack dependencies
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
-        dirmngr \
-        g++ \
         git \
-        gnupg \
+        gcc \
+        g++ \
+        libc6-dev \
+        libffi-dev \
+        libgmp-dev \
         libsqlite3-dev \
         libtinfo-dev \
         make \
@@ -19,36 +60,18 @@ RUN apt-get update && \
         zlib1g-dev && \
     rm -rf /var/lib/apt/lists/*
 
-ARG GHC=8.10.4
-ARG DEBIAN_KEY=427CB69AAC9D00F2A43CAF1CBA3CBA3FFE22B574
-ARG CABAL_INSTALL=3.4
+COPY --from=builder /usr/local/bin /usr/local/bin
+COPY --from=builder /opt/ghc/bin /opt/ghc/bin
+COPY --from=builder /opt/ghc/lib /opt/ghc/lib
 
-RUN export GNUPGHOME="$(mktemp -d)" && \
-    gpg --batch --keyserver keyserver.ubuntu.com --recv-keys ${DEBIAN_KEY} && \
-    gpg --batch --armor --export ${DEBIAN_KEY} > /etc/apt/trusted.gpg.d/haskell.org.gpg.asc && \
-    gpgconf --kill all && \
-    echo 'deb http://downloads.haskell.org/debian stretch main' > /etc/apt/sources.list.d/ghc.list && \
-    apt-get update && \
-    apt-get install -y --no-install-recommends \
-        cabal-install-${CABAL_INSTALL} \
-        ghc-${GHC} && \
-    rm -rf "$GNUPGHOME" /var/lib/apt/lists/*
-
-ARG STACK=2.7.3
-ARG STACK_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
-ARG STACK_RELEASE_KEY=2C6A674E85EE3FB896AFC9B965101FF31C5C154D
-
-RUN export GNUPGHOME="$(mktemp -d)" && \
-    gpg --batch --keyserver keyserver.ubuntu.com --recv-keys ${STACK_KEY} && \
-    gpg --batch --keyserver keyserver.ubuntu.com --recv-keys ${STACK_RELEASE_KEY} && \
-    curl -fSL https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-x86_64.tar.gz -o stack.tar.gz && \
-    curl -fSL https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-x86_64.tar.gz.asc -o stack.tar.gz.asc && \
-    gpg --batch --trusted-key 0x575159689BEFB442 --verify stack.tar.gz.asc stack.tar.gz && \
-    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 && \
-    /usr/local/bin/stack config set system-ghc --global true && \
-    /usr/local/bin/stack config set install-ghc --global false && \
-    rm -rf "$GNUPGHOME" /var/lib/apt/lists/* /stack.tar.gz.asc /stack.tar.gz
-
-ENV PATH /root/.cabal/bin:/root/.local/bin:/opt/cabal/${CABAL_INSTALL}/bin:/opt/ghc/${GHC}/bin:$PATH
+# stack should use global ghc
+RUN /usr/local/bin/stack config set system-ghc --global true && \
+    /usr/local/bin/stack config set install-ghc --global false
+
+# ensure any user gets GHC on the path
+RUN echo 'export PATH="/opt/ghc/bin:$PATH"' >> /etc/profile.d/ghc_path.sh && \
+	chmod +x /etc/profile.d/ghc_path.sh
+
+ENV PATH /root/.cabal/bin:/root/.local/bin:/opt/ghc/bin:$PATH
 
 CMD ["ghci"]
diff --git a/9.0/buster/Dockerfile b/9.0/buster/Dockerfile
index 958c808..3aa1b79 100644
--- a/9.0/buster/Dockerfile
+++ b/9.0/buster/Dockerfile
@@ -1,15 +1,56 @@
+FROM debian:buster AS builder
+
+ENV LANG C.UTF-8
+
+# to install ghcup + ghc, cabal and stack
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        build-essential \
+        ca-certificates \
+        curl \
+        libffi-dev \
+        libffi6 \
+        libgmp-dev \
+        libgmp10 \
+        libncurses-dev \
+        libncurses5 \
+        libtinfo5 && \
+    rm -rf /var/lib/apt/lists/*
+
+# install ghcup
+ARG GHCUP_VERSION=0.1.16.2
+RUN curl --proto '=https' --tlsv1.2 -sSf https://downloads.haskell.org/~ghcup/$GHCUP_VERSION/x86_64-linux-ghcup-$GHCUP_VERSION > /usr/bin/ghcup && \
+    chmod +x /usr/bin/ghcup
+
+# install cabal
+ARG CABAL_VERSION=3.4.0.0
+RUN ghcup install cabal -i /usr/local/bin $CABAL_VERSION
+
+# install stack
+ARG STACK_VERSION=2.7.3
+RUN ghcup install stack -i /usr/local/bin $STACK_VERSION
+
+# install GHC into /opt/ghc + remove profiling support
+ARG GHC_VERSION=9.0.1
+RUN ghcup install ghc -i /opt/ghc $GHC_VERSION && \
+  find /opt/ghc/lib -name "*.p_hi" -type f -delete && \
+  find /opt/ghc/lib -name "*_p.a" -type f -delete
+
 FROM debian:buster
 
 ENV LANG C.UTF-8
 
+# common haskell + stack dependencies
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
-        dirmngr \
-        g++ \
         git \
-        gnupg \
+        gcc \
+        g++ \
+        libc6-dev \
+        libffi-dev \
+        libgmp-dev \
         libsqlite3-dev \
         libtinfo-dev \
         make \
@@ -19,36 +60,18 @@ RUN apt-get update && \
         zlib1g-dev && \
     rm -rf /var/lib/apt/lists/*
 
-ARG GHC=9.0.1
-ARG DEBIAN_KEY=427CB69AAC9D00F2A43CAF1CBA3CBA3FFE22B574
-ARG CABAL_INSTALL=3.4
+COPY --from=builder /usr/local/bin /usr/local/bin
+COPY --from=builder /opt/ghc/bin /opt/ghc/bin
+COPY --from=builder /opt/ghc/lib /opt/ghc/lib
 
-RUN export GNUPGHOME="$(mktemp -d)" && \
-    gpg --batch --keyserver keyserver.ubuntu.com --recv-keys ${DEBIAN_KEY} && \
-    gpg --batch --armor --export ${DEBIAN_KEY} > /etc/apt/trusted.gpg.d/haskell.org.gpg.asc && \
-    gpgconf --kill all && \
-    echo 'deb http://downloads.haskell.org/debian buster main' > /etc/apt/sources.list.d/ghc.list && \
-    apt-get update && \
-    apt-get install -y --no-install-recommends \
-        cabal-install-${CABAL_INSTALL} \
-        ghc-${GHC} && \
-    rm -rf "$GNUPGHOME" /var/lib/apt/lists/*
-
-ARG STACK=2.7.3
-ARG STACK_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
-ARG STACK_RELEASE_KEY=2C6A674E85EE3FB896AFC9B965101FF31C5C154D
-
-RUN export GNUPGHOME="$(mktemp -d)" && \
-    gpg --batch --keyserver keyserver.ubuntu.com --recv-keys ${STACK_KEY} && \
-    gpg --batch --keyserver keyserver.ubuntu.com --recv-keys ${STACK_RELEASE_KEY} && \
-    curl -fSL https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-x86_64.tar.gz -o stack.tar.gz && \
-    curl -fSL https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-x86_64.tar.gz.asc -o stack.tar.gz.asc && \
-    gpg --batch --trusted-key 0x575159689BEFB442 --verify stack.tar.gz.asc stack.tar.gz && \
-    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 && \
-    /usr/local/bin/stack config set system-ghc --global true && \
-    /usr/local/bin/stack config set install-ghc --global false && \
-    rm -rf "$GNUPGHOME" /var/lib/apt/lists/* /stack.tar.gz.asc /stack.tar.gz
-
-ENV PATH /root/.cabal/bin:/root/.local/bin:/opt/cabal/${CABAL_INSTALL}/bin:/opt/ghc/${GHC}/bin:$PATH
+# stack should use global ghc
+RUN /usr/local/bin/stack config set system-ghc --global true && \
+    /usr/local/bin/stack config set install-ghc --global false
+
+# ensure any user gets GHC on the path
+RUN echo 'export PATH="/opt/ghc/bin:$PATH"' >> /etc/profile.d/ghc_path.sh && \
+	chmod +x /etc/profile.d/ghc_path.sh
+
+ENV PATH /root/.cabal/bin:/root/.local/bin:/opt/ghc/bin:$PATH
 
 CMD ["ghci"]
diff --git a/9.0/stretch/Dockerfile b/9.0/stretch/Dockerfile
index 892fc72..248a984 100644
--- a/9.0/stretch/Dockerfile
+++ b/9.0/stretch/Dockerfile
@@ -1,15 +1,18 @@
-FROM debian:stretch
+FROM debian:stretch AS builder
 
 ENV LANG C.UTF-8
 
+# to install ghcup + ghc, cabal and stack
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
         ca-certificates \
         curl \
-        dirmngr \
-        g++ \
         git \
-        gnupg \
+        gcc \
+        g++ \
+        libc6-dev \
+        libffi-dev \
+        libgmp-dev \
         libsqlite3-dev \
         libtinfo-dev \
         make \
@@ -19,36 +22,59 @@ RUN apt-get update && \
         zlib1g-dev && \
     rm -rf /var/lib/apt/lists/*
 
-ARG GHC=9.0.1
-ARG DEBIAN_KEY=427CB69AAC9D00F2A43CAF1CBA3CBA3FFE22B574
-ARG CABAL_INSTALL=3.4
+# install ghcup
+ARG GHCUP_VERSION=0.1.16.2
+RUN curl --proto '=https' --tlsv1.2 -sSf https://downloads.haskell.org/~ghcup/$GHCUP_VERSION/x86_64-linux-ghcup-$GHCUP_VERSION > /usr/bin/ghcup && \
+    chmod +x /usr/bin/ghcup
+
+# install cabal
+ARG CABAL_VERSION=3.4.0.0
+RUN ghcup install cabal -i /usr/local/bin $CABAL_VERSION
+
+# install stack
+ARG STACK_VERSION=2.7.3
+RUN ghcup install stack -i /usr/local/bin $STACK_VERSION
+
+# install GHC into /opt/ghc + remove profiling support
+ARG GHC_VERSION=9.0.1
+RUN ghcup install ghc -i /opt/ghc $GHC_VERSION && \
+  find /opt/ghc/lib -name "*.p_hi" -type f -delete && \
+  find /opt/ghc/lib -name "*_p.a" -type f -delete
 
-RUN export GNUPGHOME="$(mktemp -d)" && \
-    gpg --batch --keyserver keyserver.ubuntu.com --recv-keys ${DEBIAN_KEY} && \
-    gpg --batch --armor --export ${DEBIAN_KEY} > /etc/apt/trusted.gpg.d/haskell.org.gpg.asc && \
-    gpgconf --kill all && \
-    echo 'deb http://downloads.haskell.org/debian stretch main' > /etc/apt/sources.list.d/ghc.list && \
-    apt-get update && \
+FROM debian:stretch
+
+ENV LANG C.UTF-8
+
+# common haskell + stack dependencies
+RUN apt-get update && \
     apt-get install -y --no-install-recommends \
-        cabal-install-${CABAL_INSTALL} \
-        ghc-${GHC} && \
-    rm -rf "$GNUPGHOME" /var/lib/apt/lists/*
-
-ARG STACK=2.7.3
-ARG STACK_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
-ARG STACK_RELEASE_KEY=2C6A674E85EE3FB896AFC9B965101FF31C5C154D
-
-RUN export GNUPGHOME="$(mktemp -d)" && \
-    gpg --batch --keyserver keyserver.ubuntu.com --recv-keys ${STACK_KEY} && \
-    gpg --batch --keyserver keyserver.ubuntu.com --recv-keys ${STACK_RELEASE_KEY} && \
-    curl -fSL https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-x86_64.tar.gz -o stack.tar.gz && \
-    curl -fSL https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-x86_64.tar.gz.asc -o stack.tar.gz.asc && \
-    gpg --batch --trusted-key 0x575159689BEFB442 --verify stack.tar.gz.asc stack.tar.gz && \
-    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 && \
-    /usr/local/bin/stack config set system-ghc --global true && \
-    /usr/local/bin/stack config set install-ghc --global false && \
-    rm -rf "$GNUPGHOME" /var/lib/apt/lists/* /stack.tar.gz.asc /stack.tar.gz
-
-ENV PATH /root/.cabal/bin:/root/.local/bin:/opt/cabal/${CABAL_INSTALL}/bin:/opt/ghc/${GHC}/bin:$PATH
+        ca-certificates \
+        g++ \
+        gcc \
+        git \
+        gnupg \
+        libc6-dev \
+        libffi-dev \
+        libgmp-dev \
+        libtinfo-dev \
+        make \
+        netbase \
+        xz-utils \
+        zlib1g-dev && \
+    rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /usr/local/bin /usr/local/bin
+COPY --from=builder /opt/ghc/bin /opt/ghc/bin
+COPY --from=builder /opt/ghc/lib /opt/ghc/lib
+
+# stack should use global ghc
+RUN /usr/local/bin/stack config set system-ghc --global true && \
+    /usr/local/bin/stack config set install-ghc --global false
+
+# ensure any user gets GHC on the path
+RUN echo 'export PATH="/opt/ghc/bin:$PATH"' >> /etc/profile.d/ghc_path.sh && \
+	chmod +x /etc/profile.d/ghc_path.sh
+
+ENV PATH /root/.cabal/bin:/root/.local/bin:/opt/ghc/bin:$PATH
 
 CMD ["ghci"]