diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2cd314dbf1..2f4e257f57 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -55,11 +55,12 @@ jobs:
         include:
           - # If upgrading the Haskell image, also upgrade it in the lint job below
             os: ["ubuntu-latest"]
-            image: haskell:9.2.8@sha256:b3b2f3909c7381bb96b8f18766f9407a3d6f61e0f07ea95e812583ac4f442cbb
+            image: haskell:9.2.8@sha256:203bc96f3f7bf18af230408683d048a8849e9101ee2ddba55588600f2b27ac69
+          - os: ["ubuntu-24.04-arm"]
+            image: haskell:9.2.8@sha256:203bc96f3f7bf18af230408683d048a8849e9101ee2ddba55588600f2b27ac69
           - os: ["macOS-14"]
           - os: ["windows-2019"]
           - os: ["self-hosted", "macos", "ARM64"]
-          - os: ["self-hosted", "Linux", "ARM64"]
 
     runs-on: "${{ matrix.os }}"
     container: "${{ matrix.image }}"
@@ -71,7 +72,7 @@ jobs:
     steps:
       - # We need `gh` installed on the Linux version. Otherwise, release artifacts won't be uploaded.
         name: "(Linux only) Install gh"
-        if: "contains(matrix.os, 'ubuntu-latest')"
+        if: "contains(matrix.os, 'ubuntu-latest') || contains(matrix.os, 'ubuntu-24.04-arm')"
         run: |
           curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
           chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg
@@ -89,7 +90,7 @@ jobs:
         # Note: here we exclude the self-hosted runners because this action does not work on ARM
         # and their Haskell environment is instead provided by a nix-shell
         # See https://github.com/purescript/purescript/pulls/4455
-        if: "!contains(matrix.os, 'ubuntu-latest') && !contains(matrix.os, 'self-hosted')"
+        if: "!contains(matrix.os, 'ubuntu-latest') && !contains(matrix.os, 'ubuntu-24.04-arm') && !contains(matrix.os, 'self-hosted')"
         uses: "haskell-actions/setup@v2"
         with:
           enable-stack: true
@@ -97,7 +98,7 @@ jobs:
           stack-no-global: true
 
       - name: "(Linux only) Check Stack version and fix working directory ownership"
-        if: "contains(matrix.os, 'ubuntu-latest')"
+        if: "contains(matrix.os, 'ubuntu-latest') || contains(matrix.os, 'ubuntu-24.04-arm')"
         run: |
           [ "$(stack --numeric-version)" = "$STACK_VERSION" ]
           chown root:root .
@@ -122,7 +123,7 @@ jobs:
         run: "ci/fix-home ci/build.sh"
 
       - name: "(Linux only) Glob tests"
-        if: "contains(matrix.os, 'ubuntu-latest')"
+        if: "contains(matrix.os, 'ubuntu-latest') || contains(matrix.os, 'ubuntu-24.04-arm')"
         working-directory: "sdist-test"
         # We build in this directory in build.sh, so this is where we need to
         # launch `stack exec`. The actual glob checks happen in a temporary directory.
@@ -131,7 +132,7 @@ jobs:
           ../ci/fix-home stack exec bash ../glob-test.sh
 
       - name: "(Linux only) Build the entire package set"
-        if: "contains(matrix.os, 'ubuntu-latest')"
+        if: "contains(matrix.os, 'ubuntu-latest') || contains(matrix.os, 'ubuntu-24.04-arm')"
         # We build in this directory in build.sh, so this is where we need to
         # launch `stack exec`. The actual package-set building happens in a
         # temporary directory.
@@ -199,7 +200,7 @@ jobs:
 
       - name: "(Prerelease only) Upload bundle"
         if: "${{ env.CI_PRERELEASE == 'true' && steps.build.outputs.do-not-prerelease != 'true' }}"
-        uses: "actions/upload-artifact@v3"
+        uses: "actions/upload-artifact@v4.6.0"
         with:
           name: "${{ runner.os }}-${{ runner.arch }}-bundle"
           path: |
@@ -215,14 +216,14 @@ jobs:
         run: "gh release upload --clobber ${{ github.ref_name }} sdist-test/bundle/*.{tar.gz,sha}"
 
   lint:
-    runs-on: "ubuntu-latest"
+    runs-on: "ubuntu-latest" # no need for ARM
     # At the moment, this is a different image from the image used for
     # compilation, though the GHC versions match. This is because the
     # compilation image uses an old version of glibc, which we want because it
     # means our published binaries will work on the widest number of platforms.
     # But the HLint binary downloaded by this job requires a newer glibc
     # version.
-    container: haskell:9.2.8@sha256:b3b2f3909c7381bb96b8f18766f9407a3d6f61e0f07ea95e812583ac4f442cbb
+    container: haskell:9.2.8@sha256:203bc96f3f7bf18af230408683d048a8849e9101ee2ddba55588600f2b27ac69
 
     steps:
       - uses: "actions/checkout@v2"
@@ -273,7 +274,7 @@ jobs:
       - run: "ci/fix-home stack exec weeder"
 
   make-prerelease:
-    runs-on: "ubuntu-latest"
+    runs-on: "ubuntu-latest" # need ARM?
     needs:
       - "build"
       - "lint"