diff --git a/.github/workflows/debian.yml b/.github/workflows/debian.yml
index 4c79ce4..0161043 100644
--- a/.github/workflows/debian.yml
+++ b/.github/workflows/debian.yml
@@ -90,7 +90,8 @@ jobs:
             docker build --pull \
               --platform "linux/${{ matrix.docker_platform }}" \
               -t haskell:${{ matrix.ghc }}-${{ matrix.deb }} \
-              ${{ matrix.ghc_minor }}/${{ matrix.deb }}
+              -f ${{ matrix.ghc_minor }}_${{ matrix.deb }}.dockerfile
+              .
             echo 'testing..'
             docker run \
               --platform "linux/${{ matrix.docker_platform }}" \
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 3b4e6ef..f16cbe0 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -6,6 +6,7 @@ on:
       - master
     paths:
       - '**/Dockerfile'
+      - '*.dockerfile'
       - '.github/workflows/lint.yml'
 
 jobs:
diff --git a/8.10/buster/Dockerfile b/8.10_buster.dockerfile
similarity index 71%
rename from 8.10/buster/Dockerfile
rename to 8.10_buster.dockerfile
index a23f0a2..c02a69d 100644
--- a/8.10/buster/Dockerfile
+++ b/8.10_buster.dockerfile
@@ -9,45 +9,11 @@ RUN apt-get update && \
         libtinfo-dev && \
     rm -rf /var/lib/apt/lists/*
 
-ARG STACK=2.9.1
+ARG STACK=2.9.3
 ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    INSTALL_STACK="true"; \
-    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
-    # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
-    case "$ARCH" in \
-        'aarch64') \
-            # Stack does not officially support ARM64, nor do the binaries that exist work.
-            # Hitting https://github.com/commercialhaskell/stack/issues/2103#issuecomment-972329065 when trying to use
-            # stack-2.7.1-linux-aarch64.tar.gz
-            INSTALL_STACK="false"; \
-            ;; \
-        'x86_64') \
-            STACK_SHA256='0581cebe880b8ed47556ee73d8bbb9d602b5b82e38f89f6aa53acaec37e7760d'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    if [ "$INSTALL_STACK" = "true" ]; then \
-        curl -sSL "$STACK_URL" -o stack.tar.gz; \
-        echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check; \
-        \
-        curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
-        GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-        gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
-        gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
-        gpgconf --kill all; \
-        \
-        tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
-        stack config set system-ghc --global true; \
-        stack config set install-ghc --global false; \
-        \
-        rm -rf /tmp/*; \
-        \
-        stack --version; \
-    fi
+COPY ./install-stack.sh ./
+RUN ./install-stack.sh
 
 ARG CABAL_INSTALL=3.8.1.0
 ARG CABAL_INSTALL_RELEASE_KEY=E9EC5616017C3EE26B33468CCE1ED8AE0B011D8C
diff --git a/8.10/slim-buster/Dockerfile b/8.10_slim-buster.dockerfile
similarity index 72%
rename from 8.10/slim-buster/Dockerfile
rename to 8.10_slim-buster.dockerfile
index e062877..ad1a821 100644
--- a/8.10/slim-buster/Dockerfile
+++ b/8.10_slim-buster.dockerfile
@@ -23,45 +23,11 @@ RUN apt-get update && \
         zlib1g-dev && \
     rm -rf /var/lib/apt/lists/*
 
-ARG STACK=2.9.1
+ARG STACK=2.9.3
 ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    INSTALL_STACK="true"; \
-    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
-    # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
-    case "$ARCH" in \
-        'aarch64') \
-            # Stack does not officially support ARM64, nor do the binaries that exist work.
-            # Hitting https://github.com/commercialhaskell/stack/issues/2103#issuecomment-972329065 when trying to use
-            # stack-2.7.1-linux-aarch64.tar.gz
-            INSTALL_STACK="false"; \
-            ;; \
-        'x86_64') \
-            STACK_SHA256='0581cebe880b8ed47556ee73d8bbb9d602b5b82e38f89f6aa53acaec37e7760d'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    if [ "$INSTALL_STACK" = "true" ]; then \
-        curl -sSL "$STACK_URL" -o stack.tar.gz; \
-        echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check; \
-        \
-        curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
-        GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-        gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
-        gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
-        gpgconf --kill all; \
-        \
-        tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
-        stack config set system-ghc --global true; \
-        stack config set install-ghc --global false; \
-        \
-        rm -rf /tmp/*; \
-        \
-        stack --version; \
-    fi
+COPY ./install-stack.sh ./
+RUN ./install-stack.sh
 
 ARG CABAL_INSTALL=3.8.1.0
 ARG CABAL_INSTALL_RELEASE_KEY=E9EC5616017C3EE26B33468CCE1ED8AE0B011D8C
diff --git a/9.0/buster/Dockerfile b/9.0_buster.dockerfile
similarity index 71%
rename from 9.0/buster/Dockerfile
rename to 9.0_buster.dockerfile
index e628277..af27e80 100644
--- a/9.0/buster/Dockerfile
+++ b/9.0_buster.dockerfile
@@ -9,45 +9,11 @@ RUN apt-get update && \
         libtinfo-dev && \
     rm -rf /var/lib/apt/lists/*
 
-ARG STACK=2.9.1
+ARG STACK=2.9.3
 ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    INSTALL_STACK="true"; \
-    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
-    # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
-    case "$ARCH" in \
-        'aarch64') \
-            # Stack does not officially support ARM64, nor do the binaries that exist work.
-            # Hitting https://github.com/commercialhaskell/stack/issues/2103#issuecomment-972329065 when trying to use
-            # stack-2.7.1-linux-aarch64.tar.gz
-            INSTALL_STACK="false"; \
-            ;; \
-        'x86_64') \
-            STACK_SHA256='0581cebe880b8ed47556ee73d8bbb9d602b5b82e38f89f6aa53acaec37e7760d'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    if [ "$INSTALL_STACK" = "true" ]; then \
-        curl -sSL "$STACK_URL" -o stack.tar.gz; \
-        echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check; \
-        \
-        curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
-        GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-        gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
-        gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
-        gpgconf --kill all; \
-        \
-        tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
-        stack config set system-ghc --global true; \
-        stack config set install-ghc --global false; \
-        \
-        rm -rf /tmp/*; \
-        \
-        stack --version; \
-    fi
+COPY ./install-stack.sh ./
+RUN ./install-stack.sh
 
 ARG CABAL_INSTALL=3.8.1.0
 ARG CABAL_INSTALL_RELEASE_KEY=E9EC5616017C3EE26B33468CCE1ED8AE0B011D8C
diff --git a/9.0/slim-buster/Dockerfile b/9.0_slim-buster.dockerfile
similarity index 72%
rename from 9.0/slim-buster/Dockerfile
rename to 9.0_slim-buster.dockerfile
index d5840fd..0f47917 100644
--- a/9.0/slim-buster/Dockerfile
+++ b/9.0_slim-buster.dockerfile
@@ -23,45 +23,11 @@ RUN apt-get update && \
         zlib1g-dev && \
     rm -rf /var/lib/apt/lists/*
 
-ARG STACK=2.9.1
+ARG STACK=2.9.3
 ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    INSTALL_STACK="true"; \
-    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
-    # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
-    case "$ARCH" in \
-        'aarch64') \
-            # Stack does not officially support ARM64, nor do the binaries that exist work.
-            # Hitting https://github.com/commercialhaskell/stack/issues/2103#issuecomment-972329065 when trying to use
-            # stack-2.7.1-linux-aarch64.tar.gz
-            INSTALL_STACK="false"; \
-            ;; \
-        'x86_64') \
-            STACK_SHA256='0581cebe880b8ed47556ee73d8bbb9d602b5b82e38f89f6aa53acaec37e7760d'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    if [ "$INSTALL_STACK" = "true" ]; then \
-        curl -sSL "$STACK_URL" -o stack.tar.gz; \
-        echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check; \
-        \
-        curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
-        GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-        gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
-        gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
-        gpgconf --kill all; \
-        \
-        tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
-        stack config set system-ghc --global true; \
-        stack config set install-ghc --global false; \
-        \
-        rm -rf /tmp/*; \
-        \
-        stack --version; \
-    fi
+COPY ./install-stack.sh ./
+RUN ./install-stack.sh
 
 ARG CABAL_INSTALL=3.8.1.0
 ARG CABAL_INSTALL_RELEASE_KEY=E9EC5616017C3EE26B33468CCE1ED8AE0B011D8C
diff --git a/9.2/buster/Dockerfile b/9.2_buster.dockerfile
similarity index 66%
rename from 9.2/buster/Dockerfile
rename to 9.2_buster.dockerfile
index 921b931..01ac87f 100644
--- a/9.2/buster/Dockerfile
+++ b/9.2_buster.dockerfile
@@ -9,45 +9,11 @@ RUN apt-get update && \
         libtinfo-dev && \
     rm -rf /var/lib/apt/lists/*
 
-ARG STACK=2.9.1
+ARG STACK=2.9.3
 ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    INSTALL_STACK="true"; \
-    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
-    # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
-    case "$ARCH" in \
-        'aarch64') \
-            # Stack does not officially support ARM64, nor do the binaries that exist work.
-            # Hitting https://github.com/commercialhaskell/stack/issues/2103#issuecomment-972329065 when trying to use
-            # stack-2.7.1-linux-aarch64.tar.gz
-            INSTALL_STACK="false"; \
-            ;; \
-        'x86_64') \
-            STACK_SHA256='0581cebe880b8ed47556ee73d8bbb9d602b5b82e38f89f6aa53acaec37e7760d'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    if [ "$INSTALL_STACK" = "true" ]; then \
-        curl -sSL "$STACK_URL" -o stack.tar.gz; \
-        echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check; \
-        \
-        curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
-        GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-        gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
-        gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
-        gpgconf --kill all; \
-        \
-        tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
-        stack config set system-ghc --global true; \
-        stack config set install-ghc --global false; \
-        \
-        rm -rf /tmp/*; \
-        \
-        stack --version; \
-    fi
+COPY ./install-stack.sh ./
+RUN ./install-stack.sh
 
 ARG CABAL_INSTALL=3.8.1.0
 ARG CABAL_INSTALL_RELEASE_KEY=E9EC5616017C3EE26B33468CCE1ED8AE0B011D8C
diff --git a/9.2/slim-buster/Dockerfile b/9.2_slim-buster.dockerfile
similarity index 68%
rename from 9.2/slim-buster/Dockerfile
rename to 9.2_slim-buster.dockerfile
index ef33a3d..558c053 100644
--- a/9.2/slim-buster/Dockerfile
+++ b/9.2_slim-buster.dockerfile
@@ -23,45 +23,11 @@ RUN apt-get update && \
         zlib1g-dev && \
     rm -rf /var/lib/apt/lists/*
 
-ARG STACK=2.9.1
+ARG STACK=2.9.3
 ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    INSTALL_STACK="true"; \
-    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
-    # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
-    case "$ARCH" in \
-        'aarch64') \
-            # Stack does not officially support ARM64, nor do the binaries that exist work.
-            # Hitting https://github.com/commercialhaskell/stack/issues/2103#issuecomment-972329065 when trying to use
-            # stack-2.7.1-linux-aarch64.tar.gz
-            INSTALL_STACK="false"; \
-            ;; \
-        'x86_64') \
-            STACK_SHA256='0581cebe880b8ed47556ee73d8bbb9d602b5b82e38f89f6aa53acaec37e7760d'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    if [ "$INSTALL_STACK" = "true" ]; then \
-        curl -sSL "$STACK_URL" -o stack.tar.gz; \
-        echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check; \
-        \
-        curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
-        GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-        gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
-        gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
-        gpgconf --kill all; \
-        \
-        tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
-        stack config set system-ghc --global true; \
-        stack config set install-ghc --global false; \
-        \
-        rm -rf /tmp/*; \
-        \
-        stack --version; \
-    fi
+COPY ./install-stack.sh ./
+RUN ./install-stack.sh
 
 ARG CABAL_INSTALL=3.8.1.0
 ARG CABAL_INSTALL_RELEASE_KEY=E9EC5616017C3EE26B33468CCE1ED8AE0B011D8C
diff --git a/9.4/buster/Dockerfile b/9.4_buster.dockerfile
similarity index 66%
rename from 9.4/buster/Dockerfile
rename to 9.4_buster.dockerfile
index 8a03984..7f56860 100644
--- a/9.4/buster/Dockerfile
+++ b/9.4_buster.dockerfile
@@ -9,45 +9,11 @@ RUN apt-get update && \
         libtinfo-dev && \
     rm -rf /var/lib/apt/lists/*
 
-ARG STACK=2.9.1
+ARG STACK=2.9.3
 ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    INSTALL_STACK="true"; \
-    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
-    # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
-    case "$ARCH" in \
-        'aarch64') \
-            # Stack does not officially support ARM64, nor do the binaries that exist work.
-            # Hitting https://github.com/commercialhaskell/stack/issues/2103#issuecomment-972329065 when trying to use
-            # stack-2.7.1-linux-aarch64.tar.gz
-            INSTALL_STACK="false"; \
-            ;; \
-        'x86_64') \
-            STACK_SHA256='0581cebe880b8ed47556ee73d8bbb9d602b5b82e38f89f6aa53acaec37e7760d'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    if [ "$INSTALL_STACK" = "true" ]; then \
-        curl -sSL "$STACK_URL" -o stack.tar.gz; \
-        echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check; \
-        \
-        curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
-        GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-        gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
-        gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
-        gpgconf --kill all; \
-        \
-        tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
-        stack config set system-ghc --global true; \
-        stack config set install-ghc --global false; \
-        \
-        rm -rf /tmp/*; \
-        \
-        stack --version; \
-    fi
+COPY ./install-stack.sh ./
+RUN ./install-stack.sh
 
 ARG CABAL_INSTALL=3.8.1.0
 ARG CABAL_INSTALL_RELEASE_KEY=E9EC5616017C3EE26B33468CCE1ED8AE0B011D8C
diff --git a/9.4/slim-buster/Dockerfile b/9.4_slim-buster.dockerfile
similarity index 68%
rename from 9.4/slim-buster/Dockerfile
rename to 9.4_slim-buster.dockerfile
index df2c338..68df6da 100644
--- a/9.4/slim-buster/Dockerfile
+++ b/9.4_slim-buster.dockerfile
@@ -23,45 +23,11 @@ RUN apt-get update && \
         zlib1g-dev && \
     rm -rf /var/lib/apt/lists/*
 
-ARG STACK=2.9.1
+ARG STACK=2.9.3
 ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
 
-RUN set -eux; \
-    cd /tmp; \
-    ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)"; \
-    INSTALL_STACK="true"; \
-    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
-    # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
-    case "$ARCH" in \
-        'aarch64') \
-            # Stack does not officially support ARM64, nor do the binaries that exist work.
-            # Hitting https://github.com/commercialhaskell/stack/issues/2103#issuecomment-972329065 when trying to use
-            # stack-2.7.1-linux-aarch64.tar.gz
-            INSTALL_STACK="false"; \
-            ;; \
-        'x86_64') \
-            STACK_SHA256='0581cebe880b8ed47556ee73d8bbb9d602b5b82e38f89f6aa53acaec37e7760d'; \
-            ;; \
-        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
-    esac; \
-    if [ "$INSTALL_STACK" = "true" ]; then \
-        curl -sSL "$STACK_URL" -o stack.tar.gz; \
-        echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check; \
-        \
-        curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
-        GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
-        gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
-        gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
-        gpgconf --kill all; \
-        \
-        tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
-        stack config set system-ghc --global true; \
-        stack config set install-ghc --global false; \
-        \
-        rm -rf /tmp/*; \
-        \
-        stack --version; \
-    fi
+COPY ./install-stack.sh ./
+RUN ./install-stack.sh
 
 ARG CABAL_INSTALL=3.8.1.0
 ARG CABAL_INSTALL_RELEASE_KEY=E9EC5616017C3EE26B33468CCE1ED8AE0B011D8C
diff --git a/install-stack.sh b/install-stack.sh
new file mode 100755
index 0000000..9554b50
--- /dev/null
+++ b/install-stack.sh
@@ -0,0 +1,33 @@
+#! /bin/sh
+
+set -eux;
+
+cd /tmp;
+ARCH="$(dpkg-architecture --query DEB_BUILD_GNU_CPU)";
+STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz";
+# sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
+case "$ARCH" in
+    'aarch64')
+        STACK_SHA256='0581cebe880b8ed47556ee73d8bbb9d602b5b82e38f89f6aa53acaec37e7760d';
+        ;;
+    'x86_64')
+        STACK_SHA256='0581cebe880b8ed47556ee73d8bbb9d602b5b82e38f89f6aa53acaec37e7760d';
+        ;;
+    *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;;
+esac;
+curl -sSL "$STACK_URL" -o stack.tar.gz;
+echo "$STACK_SHA256 stack.tar.gz" | sha256sum --strict --check;
+
+curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc;
+GNUPGHOME="$(mktemp -d)"; export GNUPGHOME;
+gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY";
+gpg --batch --verify stack.tar.gz.asc stack.tar.gz;
+gpgconf --kill all;
+
+tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack";
+stack config set system-ghc --global true;
+stack config set install-ghc --global false;
+
+rm -rf /tmp/*;
+
+stack --version;