diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 9d31b76bcd504554706000d4300f47bc15e30288..f40e97210f12f6ed469dccf315d3a5d0dde0e636 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -2,7 +2,9 @@ variables:
   GIT_SSL_NO_VERIFY: "1"
 
   # Commit of ghc/ci-images repository from which to pull Docker images
-  DOCKER_REV: efc1ab81236eb37e20cb287ec77aebb6c6341098
+  DOCKER_REV: 66be29543a78357dfcdd90c112989d006dbed0ba
+
+  GHC_WASM_META_BRANCH: master
 
   # Sequential version number of all cached things.
   # Bump to invalidate GitLab CI cache.
@@ -97,6 +99,7 @@ workflow:
     - if: $CI_PROJECT_ID == "1" && $CI_COMMIT_BRANCH == "master"
     - if: $CI_PROJECT_ID == "1" && $CI_COMMIT_BRANCH =~ /ghc-[0-9]+\.[0-9]+/
     - if: '$CI_PIPELINE_SOURCE == "web"'
+    - if: $CI_PIPELINE_SOURCE == "pipeline"
 
 # which versions of GHC to allow bootstrap with
 .bootstrap_matrix : &bootstrap_matrix
@@ -222,30 +225,6 @@ ghc-linters:
     - if: $CI_MERGE_REQUEST_ID
     - *drafts-can-fail-lint
 
-# Run mypy Python typechecker on linter scripts.
-lint-linters:
-  image: "registry.gitlab.haskell.org/ghc/ci-images/linters:$DOCKER_REV"
-  extends: .lint
-  script:
-    - mypy testsuite/tests/linters/regex-linters/*.py
-  dependencies: []
-
-# Check that .T files all parse by listing broken tests.
-lint-testsuite:
-  image: "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-deb9:$DOCKER_REV"
-  extends: .lint
-  script:
-    - make -Ctestsuite list_broken TEST_HC=$GHC
-  dependencies: []
-
-# Run mypy Python typechecker on testsuite driver
-typecheck-testsuite:
-  image: "registry.gitlab.haskell.org/ghc/ci-images/linters:$DOCKER_REV"
-  extends: .lint
-  script:
-    - mypy testsuite/driver/runtests.py
-  dependencies: []
-
 # We allow the submodule checker to fail when run on merge requests (to
 # accommodate, e.g., haddock changes not yet upstream) but not on `master` or
 # Marge jobs.
@@ -282,51 +261,6 @@ lint-author:
     - if: $CI_MERGE_REQUEST_ID
     - *drafts-can-fail-lint
 
-lint-ci-config:
-  image: nixos/nix:2.14.1
-  extends: .lint
-  # We don't need history/submodules in this job
-  variables:
-    GIT_DEPTH: 1
-    GIT_SUBMODULE_STRATEGY: none
-  before_script:
-    - echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf
-    - nix-channel --update
-  script:
-    - .gitlab/generate_jobs
-    # 1 if .gitlab/generate_jobs changed the output of the generated config
-    - nix shell nixpkgs#git -c git diff --exit-code
-    # And run this to just make sure that works
-    - .gitlab/generate_job_metadata
-  dependencies: []
-
-lint-submods:
-  extends: .lint-submods
-  # Allow failure on merge requests since any necessary submodule patches may
-  # not be upstreamed yet.
-  rules:
-    - if: '$CI_MERGE_REQUEST_LABELS =~ /.*marge_bot_batch_merge_job.*/'
-      allow_failure: false
-    # Don't run on nightly because the program needs a base commit to check.
-    - if: $NIGHTLY
-      when: never
-    - allow_failure: true
-
-lint-submods-branch:
-  extends: .lint-submods
-  variables:
-    BUILD_FLAVOUR: default
-  script:
-    - .gitlab/ci.sh configure
-    - .gitlab/ci.sh run_hadrian stage0:exe:lint-submodule-refs
-    - "echo Linting submodule changes between $CI_COMMIT_BEFORE_SHA..$CI_COMMIT_SHA"
-    - git submodule foreach git remote update
-    - _build/stageBoot/bin/lint-submodule-refs . $(git rev-list $CI_COMMIT_BEFORE_SHA..$CI_COMMIT_SHA)
-  rules:
-    - if: '$CI_COMMIT_BRANCH == "master"'
-    - if: '$CI_COMMIT_BRANCH =~ /ghc-[0.9]+\.[0-9]+/'
-    - *drafts-can-fail-lint
-
 ############################################################
 # GHC source code linting
 ############################################################
@@ -369,10 +303,8 @@ lint-submods-branch:
 hadrian-ghc-in-ghci:
   stage: quick-build
   needs:
-    - job: lint-linters
-    - job: lint-submods
-      optional: true
-  image: "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-deb10:$DOCKER_REV"
+    - only-wasm
+  image: "registry.gitlab.haskell.org/ghc/ci-images/x86_64-linux-deb12:$DOCKER_REV"
   before_script:
     # workaround for docker permissions
     - sudo chown ghc:ghc -R .
@@ -449,21 +381,6 @@ hadrian-multi:
   rules:
     - if: '$CI_MERGE_REQUEST_LABELS !~ /.*fast-ci.*/'
 
-############################################################
-# stack-hadrian-build
-############################################################
-
-# Verify that Hadrian builds with stack. Note that we don't actually perform a
-# build of GHC itself; we merely test that the Hadrian executable builds and
-# works (by invoking `hadrian --version`).
-stack-hadrian-build:
-  extends: hadrian-ghc-in-ghci
-  stage: quick-build
-  script:
-    - .gitlab/ci.sh setup
-    - .gitlab/ci.sh configure
-    - hadrian/build-stack --version
-
 ####################################
 # Testing reinstallable ghc codepath
 ####################################
@@ -1173,3 +1090,36 @@ ghcup-metadata-testing-release:
   rules:
     - if: '$RELEASE_JOB == "yes"'
   when: manual
+
+only-wasm:
+  stage: quick-build
+  image: nixos/nix:2.26.1
+  tags:
+    - x86_64-linux
+  needs: []
+  variables:
+    GIT_STRATEGY: none
+    KEEP_JOB_NAME: x86_64-linux-alpine3_20-wasm-cross_wasm32-wasi-release+host_fully_static
+  before_script:
+    - echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf
+    - echo "cores = $CPUS" >> /etc/nix/nix.conf
+    - echo "max-jobs = $CPUS" >> /etc/nix/nix.conf
+    - nix run nixpkgs#gnused -- -i -e 's/ nixbld//' /etc/nix/nix.conf
+  script:
+    - nix run nixpkgs#deno -- run --allow-env --allow-net https://gist.githubusercontent.com/TerrorJack/e0e886b87b9bfffb6c5fa5b3aeddcecc/raw/c927e9ef4a191d042087620965f6eb439749b9a0/cancel.js
+
+ghc-wasm-meta-ci:
+  stage: testing
+  needs:
+    - job: x86_64-linux-alpine3_20-wasm-cross_wasm32-wasi-release+host_fully_static
+      artifacts: false
+  variables:
+    UPSTREAM_GHC_FLAVOUR: "9.8"
+    UPSTREAM_GHC_PIPELINE_ID: $CI_PIPELINE_ID
+  rules:
+    - if: $UPSTREAM_WASI_SDK_PIPELINE_ID != null
+      variables:
+        UPSTREAM_WASI_SDK_PIPELINE_ID: $UPSTREAM_WASI_SDK_PIPELINE_ID
+  trigger:
+    project: haskell-wasm/ghc-wasm-meta
+    branch: $GHC_WASM_META_BRANCH
diff --git a/.gitlab/ci.sh b/.gitlab/ci.sh
index ca0147763f5dc229689f222be63db3d19847aa96..05f737265bf583e36b6f6eab771d8ebc795dbb9e 100755
--- a/.gitlab/ci.sh
+++ b/.gitlab/ci.sh
@@ -235,7 +235,45 @@ function set_toolchain_paths() {
   export ALEX
 
   if [[ "${CROSS_TARGET:-}" == *"wasm"* ]]; then
-    source "/home/ghc/.ghc-wasm/env"
+    case "$(uname)" in
+      Linux)
+        if [[ ! -f /home/ghc/.ghc-wasm/.flag ]]; then
+          sudo sed -i -e 's/v3\.[0-9][0-9]/v3\.21/g' /etc/apk/repositories
+          sudo apk upgrade --available --update-cache
+
+          curl -f -L --retry 5 https://github.com/tweag/rust-alpine-mimalloc/archive/refs/heads/master.tar.gz | tar xz -C /tmp
+          mv /tmp/rust-alpine-mimalloc-master/mimalloc.diff /tmp
+          sudo /tmp/rust-alpine-mimalloc-master/build.sh
+
+          pushd "$(mktemp -d)"
+          curl -f -L --retry 5 https://gitlab.haskell.org/haskell-wasm/ghc-wasm-meta/-/archive/$GHC_WASM_META_BRANCH/ghc-wasm-meta-$GHC_WASM_META_BRANCH.tar.gz | tar xz --strip-components=1
+          PREFIX=/home/ghc/.ghc-wasm SKIP_GHC=1 ./setup.sh
+          popd
+
+          touch /home/ghc/.ghc-wasm/.flag
+        fi
+
+        export LD_PRELOAD=/usr/lib/libmimalloc.so
+        source /home/ghc/.ghc-wasm/env
+
+        if [[ "$(uname -m)" == "aarch64" ]]; then
+          export CONFIGURE_ARGS="--host=aarch64-alpine-linux --target=wasm32-wasi --with-intree-gmp --with-system-libffi"
+        fi
+        ;;
+
+      Darwin)
+        pushd "$(mktemp -d)"
+        curl -f -L --retry 5 https://gitlab.haskell.org/haskell-wasm/ghc-wasm-meta/-/archive/$GHC_WASM_META_BRANCH/ghc-wasm-meta-$GHC_WASM_META_BRANCH.tar.gz | tar xz --strip-components=1
+        PREFIX=/Users/$(whoami)/.ghc-wasm SKIP_GHC=1 ./setup.sh
+        popd
+
+        source /Users/$(whoami)/.ghc-wasm/env
+        ;;
+
+      *)
+        fail "wasm target only supported on linux/darwin hosts"
+        ;;
+    esac
   fi
 }