diff --git a/testsuite/driver/testlib.py b/testsuite/driver/testlib.py
index 370cdf1988238201cf5213439913aff74cab8d2d..613e785e6ea547ca491a3fa22fcfbbf1311d605f 100644
--- a/testsuite/driver/testlib.py
+++ b/testsuite/driver/testlib.py
@@ -321,6 +321,16 @@ def req_process( name, opts ):
     if not config.have_process:
         opts.skip = True
 
+def req_host_target_ghc( name, opts ):
+    """
+    When testing a cross GHC, some test cases require a host GHC as
+    well (e.g. for compiling custom Setup.hs). This is not supported
+    yet (#23236), so for the time being we skip them when testing
+    cross GHCs.
+    """
+    if isCross():
+        opts.skip = True
+
 def ignore_stdout(name, opts):
     opts.ignore_stdout = True
 
diff --git a/testsuite/tests/safeHaskell/check/pkg01/all.T b/testsuite/tests/safeHaskell/check/pkg01/all.T
index c06f6d9fd48f757ea8e0520c13fedc8e2fdd806e..6121deec2a155ba1431f542536d1260094d9e5ba 100644
--- a/testsuite/tests/safeHaskell/check/pkg01/all.T
+++ b/testsuite/tests/safeHaskell/check/pkg01/all.T
@@ -54,6 +54,7 @@ test('ImpSafe04', normalise_version('base'), compile_fail, ['-fpackage-trust -di
 
 test('ImpSafeOnly01',
      [js_broken(22350),
+      req_host_target_ghc,
       extra_files(['M_SafePkg.hs', 'M_SafePkg2.hs', 'M_SafePkg3.hs', 'M_SafePkg4.hs', 'M_SafePkg5.hs', 'M_SafePkg6.hs', 'M_SafePkg7.hs', 'M_SafePkg8.hs', 'Setup.hs', 'p.cabal']),
       pre_cmd('$MAKE -s --no-print-directory mkPackageDatabase.ImpSafeOnly01 ' + make_args)],
      compile,
@@ -61,6 +62,7 @@ test('ImpSafeOnly01',
 
 test('ImpSafeOnly02',
      [js_broken(22350),
+      req_host_target_ghc,
       extra_files(['M_SafePkg.hs', 'M_SafePkg2.hs', 'M_SafePkg3.hs', 'M_SafePkg4.hs', 'M_SafePkg5.hs', 'M_SafePkg6.hs', 'M_SafePkg7.hs', 'M_SafePkg8.hs', 'Setup.hs', 'p.cabal']),
       pre_cmd('$MAKE -s --no-print-directory mkPackageDatabase.ImpSafeOnly02 ' + make_args)],
      compile,
@@ -69,6 +71,7 @@ test('ImpSafeOnly02',
 # Fail since we enable package trust (and still need safePkg01 trusted)
 test('ImpSafeOnly03',
      [js_broken(22350),
+      req_host_target_ghc,
       extra_files(['M_SafePkg.hs', 'M_SafePkg2.hs', 'M_SafePkg3.hs', 'M_SafePkg4.hs', 'M_SafePkg5.hs', 'M_SafePkg6.hs', 'M_SafePkg7.hs', 'M_SafePkg8.hs', 'Setup.hs', 'p.cabal']),
       pre_cmd('$MAKE -s --no-print-directory mkPackageDatabase.ImpSafeOnly03 ' + make_args)],
      compile_fail,
@@ -77,6 +80,7 @@ test('ImpSafeOnly03',
 # Succeed since we don't enable package trust
 test('ImpSafeOnly04',
      [js_broken(22350),
+      req_host_target_ghc,
       extra_files(['M_SafePkg.hs', 'M_SafePkg2.hs', 'M_SafePkg3.hs', 'M_SafePkg4.hs', 'M_SafePkg5.hs', 'M_SafePkg6.hs', 'M_SafePkg7.hs', 'M_SafePkg8.hs', 'Setup.hs', 'p.cabal']),
       pre_cmd('$MAKE -s --no-print-directory mkPackageDatabase.ImpSafeOnly04 ' + make_args)],
      compile, ['-package-db pdb.ImpSafeOnly04/local.db -trust base'])
@@ -84,12 +88,14 @@ test('ImpSafeOnly04',
 # fail due to missing trust of safePkg01, next test succeeds.
 test('ImpSafeOnly05',
      [js_broken(22350),
+      req_host_target_ghc,
       extra_files(['M_SafePkg.hs', 'M_SafePkg2.hs', 'M_SafePkg3.hs', 'M_SafePkg4.hs', 'M_SafePkg5.hs', 'M_SafePkg6.hs', 'M_SafePkg7.hs', 'M_SafePkg8.hs', 'Setup.hs', 'p.cabal']),
       pre_cmd('$MAKE -s --no-print-directory mkPackageDatabase.ImpSafeOnly05 ' + make_args)],
      compile_fail,
      ['-fpackage-trust -package-db pdb.ImpSafeOnly05/local.db -trust base'])
 test('ImpSafeOnly06',
      [js_broken(22350),
+      req_host_target_ghc,
       extra_files(['M_SafePkg.hs', 'M_SafePkg2.hs', 'M_SafePkg3.hs', 'M_SafePkg4.hs', 'M_SafePkg5.hs', 'M_SafePkg6.hs', 'M_SafePkg7.hs', 'M_SafePkg8.hs', 'Setup.hs', 'p.cabal']),
       pre_cmd('$MAKE -s --no-print-directory mkPackageDatabase.ImpSafeOnly06 ' + make_args)],
      compile,
@@ -98,6 +104,7 @@ test('ImpSafeOnly06',
 # fail due to missing trust
 test('ImpSafeOnly07',
      [js_broken(22350),
+      req_host_target_ghc,
       extra_files(['M_SafePkg.hs', 'M_SafePkg2.hs', 'M_SafePkg3.hs', 'M_SafePkg4.hs', 'M_SafePkg5.hs', 'M_SafePkg6.hs', 'M_SafePkg7.hs', 'M_SafePkg8.hs', 'Setup.hs', 'p.cabal']),
       pre_cmd('$MAKE -s --no-print-directory mkPackageDatabase.ImpSafeOnly07 ' + make_args),
       normalise_version("bytestring", "base")],
@@ -105,6 +112,7 @@ test('ImpSafeOnly07',
      ['-fpackage-trust -package-db pdb.ImpSafeOnly07/local.db -trust safePkg01 -distrust bytestring'])
 test('ImpSafeOnly08',
      [js_broken(22350),
+      req_host_target_ghc,
       extra_files(['M_SafePkg.hs', 'M_SafePkg2.hs', 'M_SafePkg3.hs', 'M_SafePkg4.hs', 'M_SafePkg5.hs', 'M_SafePkg6.hs', 'M_SafePkg7.hs', 'M_SafePkg8.hs', 'Setup.hs', 'p.cabal']),
       pre_cmd('$MAKE -s --no-print-directory mkPackageDatabase.ImpSafeOnly08 ' + make_args),
       normalise_version("bytestring", "base")],
@@ -112,6 +120,7 @@ test('ImpSafeOnly08',
      ['-fpackage-trust -package-db pdb.ImpSafeOnly08/local.db -trust safePkg01'])
 test('ImpSafeOnly09',
      [js_broken(22350),
+      req_host_target_ghc,
       extra_files(['M_SafePkg.hs', 'M_SafePkg2.hs', 'M_SafePkg3.hs', 'M_SafePkg4.hs', 'M_SafePkg5.hs', 'M_SafePkg6.hs', 'M_SafePkg7.hs', 'M_SafePkg8.hs', 'Setup.hs', 'p.cabal']),
       pre_cmd('$MAKE -s --no-print-directory mkPackageDatabase.ImpSafeOnly09 ' + make_args),
       normalise_version("bytestring")],
@@ -121,6 +130,7 @@ test('ImpSafeOnly09',
 # finally succeed
 test('ImpSafeOnly10',
      [js_broken(22350),
+      req_host_target_ghc,
       extra_files(['M_SafePkg.hs', 'M_SafePkg2.hs', 'M_SafePkg3.hs', 'M_SafePkg4.hs', 'M_SafePkg5.hs', 'M_SafePkg6.hs', 'M_SafePkg7.hs', 'M_SafePkg8.hs', 'Setup.hs', 'p.cabal']),
       pre_cmd('$MAKE -s --no-print-directory mkPackageDatabase.ImpSafeOnly10 ' + make_args)],
      compile,