diff --git a/.github/workflows/haskell-ci.yml b/.github/workflows/haskell-ci.yml
index abc97cb0..ecc1c91d 100644
--- a/.github/workflows/haskell-ci.yml
+++ b/.github/workflows/haskell-ci.yml
@@ -8,9 +8,9 @@
 #
 # For more information, see https://github.com/haskell-CI/haskell-ci
 #
-# version: 0.19.20250330
+# version: 0.19.20250506
 #
-# REGENDATA ("0.19.20250330",["github","hackage-server.cabal"])
+# REGENDATA ("0.19.20250506",["github","hackage-server.cabal"])
 #
 name: Haskell-CI
 on:
@@ -32,44 +32,24 @@ jobs:
     strategy:
       matrix:
         include:
-          - compiler: ghc-9.10.1
+          - compiler: ghc-9.12.2
             compilerKind: ghc
-            compilerVersion: 9.10.1
+            compilerVersion: 9.12.2
             setup-method: ghcup
             allow-failure: false
-          - compiler: ghc-9.8.2
+          - compiler: ghc-9.10.2
             compilerKind: ghc
-            compilerVersion: 9.8.2
+            compilerVersion: 9.10.2
             setup-method: ghcup
             allow-failure: false
-          - compiler: ghc-9.6.5
+          - compiler: ghc-9.8.4
             compilerKind: ghc
-            compilerVersion: 9.6.5
+            compilerVersion: 9.8.4
             setup-method: ghcup
             allow-failure: false
-          - compiler: ghc-9.4.8
+          - compiler: ghc-9.6.7
             compilerKind: ghc
-            compilerVersion: 9.4.8
-            setup-method: ghcup
-            allow-failure: false
-          - compiler: ghc-9.2.8
-            compilerKind: ghc
-            compilerVersion: 9.2.8
-            setup-method: ghcup
-            allow-failure: false
-          - compiler: ghc-9.0.2
-            compilerKind: ghc
-            compilerVersion: 9.0.2
-            setup-method: ghcup
-            allow-failure: false
-          - compiler: ghc-8.10.7
-            compilerKind: ghc
-            compilerVersion: 8.10.7
-            setup-method: ghcup
-            allow-failure: false
-          - compiler: ghc-8.8.4
-            compilerKind: ghc
-            compilerVersion: 8.8.4
+            compilerVersion: 9.6.7
             setup-method: ghcup
             allow-failure: false
       fail-fast: false
@@ -86,8 +66,8 @@ jobs:
           chmod a+x "$HOME/.ghcup/bin/ghcup"
       - name: Install cabal-install
         run: |
-          "$HOME/.ghcup/bin/ghcup" install cabal 3.14.1.1-p1 || (cat "$HOME"/.ghcup/logs/*.* && false)
-          echo "CABAL=$HOME/.ghcup/bin/cabal-3.14.1.1-p1 -vnormal+nowrap" >> "$GITHUB_ENV"
+          "$HOME/.ghcup/bin/ghcup" install cabal 3.14.2.0 || (cat "$HOME"/.ghcup/logs/*.* && false)
+          echo "CABAL=$HOME/.ghcup/bin/cabal-3.14.2.0 -vnormal+nowrap" >> "$GITHUB_ENV"
       - name: Install GHC (GHCup)
         if: matrix.setup-method == 'ghcup'
         run: |
diff --git a/.github/workflows/nix-flake.yml b/.github/workflows/nix-flake.yml
index e00d1bb8..7e1458a0 100644
--- a/.github/workflows/nix-flake.yml
+++ b/.github/workflows/nix-flake.yml
@@ -9,7 +9,7 @@ on:
 jobs:
   nix:
     strategy:
-      fail-fast: true
+      fail-fast: false
       matrix:
         os:
         - ubuntu-latest
diff --git a/cabal.haskell-ci b/cabal.haskell-ci
index 391b2ebb..bdf6a02d 100644
--- a/cabal.haskell-ci
+++ b/cabal.haskell-ci
@@ -6,8 +6,8 @@ installed: +all -Cabal -Cabal-syntax -text -parsec -process
 -- -- allow failures with ghc-7.6 and ghc-7.8
 -- allow-failures: <7.9
 
--- Use Ubuntu 22.04
-distribution: jammy
+-- -- Use Ubuntu 22.04
+-- distribution: jammy
 
 apt: libbrotli-dev libgd-dev
   -- libgd-dev is for gd via hs-captcha
diff --git a/flake.lock b/flake.lock
index a5c503a1..f690d105 100644
--- a/flake.lock
+++ b/flake.lock
@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1719994518,
-        "narHash": "sha256-pQMhCCHyQGRzdfAkdJ4cIWiw+JNuWsTX7f0ZYSyz0VY=",
+        "lastModified": 1743550720,
+        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "9227223f6d922fee3c7b190b2cc238a99527bbb7",
+        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
         "type": "github"
       },
       "original": {
@@ -22,11 +22,11 @@
     },
     "flake-root": {
       "locked": {
-        "lastModified": 1713493429,
-        "narHash": "sha256-ztz8JQkI08tjKnsTpfLqzWoKFQF4JGu2LRz8bkdnYUk=",
+        "lastModified": 1723604017,
+        "narHash": "sha256-rBtQ8gg+Dn4Sx/s+pvjdq3CB2wQNzx9XGFq/JVGCB6k=",
         "owner": "srid",
         "repo": "flake-root",
-        "rev": "bc748b93b86ee76e2032eecda33440ceb2532fcd",
+        "rev": "b759a56851e10cb13f6b8e5698af7b59c44be26e",
         "type": "github"
       },
       "original": {
@@ -37,11 +37,11 @@
     },
     "haskell-flake": {
       "locked": {
-        "lastModified": 1721530802,
-        "narHash": "sha256-eUMmQKXjt4WQq+IBscftg/Y9bXWiOYhasfeH5Yb9Psc=",
+        "lastModified": 1748249016,
+        "narHash": "sha256-VezZGWRqCG7JXacHDhONNHGjacn3Y405RzNvx0mM374=",
         "owner": "srid",
         "repo": "haskell-flake",
-        "rev": "f8f38ecd259338167cc0c85fd541479297a315af",
+        "rev": "d91a3893c867a4e6702862a751c1e24ed3dbde89",
         "type": "github"
       },
       "original": {
@@ -52,16 +52,15 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1721952842,
-        "narHash": "sha256-B6Fm/e+2Iq1LB0ITtdaVS/lxkckCwPNpgBuduuv1HzY=",
+        "lastModified": 1748795728,
+        "narHash": "sha256-QtwbTB5MmP7UoLQbaw+g2at/DQaJbn48RxAPVIQgf8Y=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "574f1a6205e63e9870c6e6132c393f9082d58d2a",
+        "rev": "9858755c272002ce525a4de5d9ec9560b2154fba",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "haskell-updates",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 82158c3a..cfafb29e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,6 +1,6 @@
 {
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/haskell-updates";
+    nixpkgs.url = "github:nixos/nixpkgs";
     flake-parts.url = "github:hercules-ci/flake-parts";
     haskell-flake.url = "github:srid/haskell-flake";
     flake-root.url = "github:srid/flake-root";
@@ -42,25 +42,57 @@
         };
         packages.default = config.packages.hackage-server;
         haskellProjects.default = {
+          basePackages = pkgs.haskell.packages.ghc910;
           settings = {
             hackage-server.check = false;
-            ap-normalize.check = false;
+
+            cabal-add.jailbreak = true;
+            cabal-install-parsers.jailbreak = true;
             # https://community.flake.parts/haskell-flake/dependency#nixpkgs
-            tar = { super, ... }:
-              { custom = _: super.tar_0_6_3_0; };
-            hackage-security = { super, ... }:
-              { custom = _: super.hackage-security_0_6_2_6; };
+            Cabal-syntax = { super, ... }:
+              { custom = _: super.Cabal-syntax_3_14_2_0; };
+            Cabal = { super, ... }:
+              { custom = _: super.Cabal_3_14_2_0; };
+            fourmolu.check = false;
+            hls-plugin-api.jailbreak = true;
+            ghcide.jailbreak = true;
+            haskell-language-server.jailbreak = true;
+
+            Diff = { super, ... }:
+              { custom = _: super.Diff_1_0_2; };
+
+            threads.check = false;
+            tree-diff.check = false;
+
+            ormolu = { super, ... }:
+              { custom = _: super.ormolu_0_8_0_0;
+                check = false;
+              };
+            extensions = { super, ... }:
+              { custom = _: super.extensions_0_1_0_3;
+                jailbreak = true;
+              };
+
+            hlint = { super, ... }:
+              { custom = _: super.hlint_3_10; };
+            ghc-lib-parser-ex = { super, ... }:
+              { custom = _: super.ghc-lib-parser-ex_9_12_0_0; };
+            ghc-lib-parser = { super, ... }:
+              {
+                # custom = _: super.ghc-lib-parser_9_12_2_20250421;
+                custom = _: super.ghc-lib-parser_9_12_2_20250320;
+              };
           };
           packages = {
             # https://community.flake.parts/haskell-flake/dependency#path
             # tls.source = "1.9.0";
+            fourmolu.source = "0.18.0.0";
           };
           devShell = {
             tools = hp: {
               inherit (pkgs)
                 cabal-install
                 ghc
-
                 # https://github.com/haskell/hackage-server/pull/1219#issuecomment-1597140858
                 # glibc
                 icu67
diff --git a/hackage-server.cabal b/hackage-server.cabal
index 6ef76b48..ed28e49c 100644
--- a/hackage-server.cabal
+++ b/hackage-server.cabal
@@ -28,14 +28,11 @@ license:      BSD-3-Clause
 license-file: LICENSE
 
 tested-with:
-  GHC == 9.10.1
-  GHC == 9.8.2
-  GHC == 9.6.5
-  GHC == 9.4.8
-  GHC == 9.2.8
-  GHC == 9.0.2
-  GHC == 8.10.7
-  GHC == 8.8.4
+  GHC == 9.12.2
+  GHC == 9.10.2
+  GHC == 9.8.4
+  GHC == 9.6.7
+  -- Constraint transformers >= 0.6 forces GHC >= 9.6 for CI
 
 data-dir: datafiles
 data-files:
@@ -130,10 +127,10 @@ common defaults
   -- see `cabal.project.local-ghc-${VERSION}` files
   build-depends:
     , array                  >= 0.5   && < 0.6
-    , base                   >= 4.13  && < 4.21
+    , base                   >= 4.18  && < 4.22
     , binary                 >= 0.8   && < 0.9
     , bytestring             >= 0.10  && < 0.13
-    , containers             >= 0.6.0 && < 0.8
+    , containers             >= 0.6.0 && < 0.9
     , deepseq                >= 1.4   && < 1.6
     , directory              >= 1.3   && < 1.4
     , filepath               >= 1.4   && < 1.6
@@ -142,15 +139,15 @@ common defaults
     , pretty                 >= 1.1   && < 1.2
     , process                >= 1.6   && < 1.7
     , text                  ^>= 1.2.5.0 || >= 2.0 && < 2.2
-    , time                   >= 1.9   && < 1.13
+    , time                   >= 1.9   && < 1.15
     , transformers           >= 0.5   && < 0.7
     , unix                   >= 2.7   && < 2.9
     , scientific
   -- other dependencies shared by most components
   build-depends:
     , aeson                  >= 2.1.0.0 && < 2.3
-    , Cabal                  >= 3.12.1.0 && < 3.14
-    , Cabal-syntax           >= 3.12.1.0 && < 3.14
+    , Cabal                  >= 3.14.2.0 && < 3.16
+    , Cabal-syntax           >= 3.14.2.0 && < 3.16
         -- Cabal-syntax needs to be bound to constrain hackage-security
         -- see https://github.com/haskell/hackage-server/issues/1130
     , fail                  ^>= 4.9.0
@@ -165,11 +162,13 @@ common defaults
 
   ghc-options:
     -funbox-strict-fields
-    -Wall -fwarn-tabs -fno-warn-unused-do-bind -fno-warn-deprecated-flags
-    -Werror=incomplete-patterns -Werror=missing-methods
-
-  if impl(ghc >= 8.10)
-    ghc-options: -Wno-unused-record-wildcards
+    -Wall
+    -Wtabs
+    -Wno-deprecated-flags
+    -Wno-unused-do-bind
+    -Wno-unused-record-wildcards
+    -Werror=incomplete-patterns
+    -Werror=missing-methods
 
   default-extensions: LambdaCase, TupleSections
   other-extensions: CPP, TemplateHaskell
@@ -444,12 +443,12 @@ library
         -- haddock-library-1.11.0 changed type of markupOrderedList
         -- see https://github.com/haskell/hackage-server/issues/1128
     , happstack-server      ^>= 7.7.1     || ^>= 7.8.0  || ^>= 7.9.0
-    , hashable              ^>= 1.3       || ^>= 1.4
+    , hashable               >= 1.3       && < 1.6
     , hs-captcha            ^>= 1.0
     , hslogger              ^>= 1.3.1
     , lifted-base           ^>= 0.2.1
     , mime-mail             ^>= 0.5
-    , random                ^>= 1.2
+    , random                 >= 1.2       && < 1.4
     , rss                   ^>= 3000.2.0.7
     , safecopy              ^>= 0.10
     , semigroups            ^>= 0.20
@@ -458,7 +457,7 @@ library
     , stringsearch          ^>= 0.3.6.6
     , tagged                ^>= 0.8.5
     , transformers          ^>= 0.6
-    , xhtml                  >= 3000.2.0.0 && < 3000.4
+    , xhtml                  >= 3000.2.0.0 && < 3000.5
     , xmlgen                ^>= 0.6
     , xss-sanitize          ^>= 0.3.6
 
@@ -541,7 +540,10 @@ common test-defaults
 
   build-depends: hackage-server
   hs-source-dirs: tests
-  ghc-options: -threaded -rtsopts -fno-warn-orphans
+  ghc-options:
+    -threaded
+    -rtsopts
+    -Wno-orphans
 
   other-modules:   Paths_hackage_server
   autogen-modules: Paths_hackage_server
@@ -600,7 +602,7 @@ test-suite ReverseDependenciesTest
     , tasty-hedgehog ^>= 1.4
     , tasty-hunit  ^>= 0.10
     , HUnit        ^>= 1.6
-    , hedgehog     ^>= 1.4
+    , hedgehog      >= 1.4 && < 1.6
     , exceptions
     , bimap
     , mime-mail
@@ -696,7 +698,7 @@ test-suite DocTests
   main-is:        DocTestMain.hs
   build-depends:
     , hackage-server
-    , doctest-parallel ^>= 0.3.0
+    , doctest-parallel ^>= 0.4
         -- doctest-parallel-0.2.2 is the first to filter out autogen-modules
 
   if !flag(doctests)