diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index dbbfeaa1d762a8c125420da841b4acc748bc90cf..7fa36cba6353efba29673944d48c23faa19bf14c 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -33,9 +33,6 @@ variables:
   # Which nixos/nix Docker image tag to use
   DOCKER_TAG: "2.3.12"
 
-  # Default GHC bindist
-  GHC_TARBALL: "https://gitlab.haskell.org/api/v4/projects/1/jobs/artifacts/master/raw/ghc-x86_64-linux-fedora33-release.tar.xz?job=x86_64-linux-fedora33-release"
-
   # Default this to ghc/ghc> to make it more convenient to run from the web
   # interface.
   UPSTREAM_PROJECT_ID: 1
@@ -93,8 +90,10 @@ test-pipeline:
 # Build against the master branch
 .build-master:
   extends: .build
+  before_script:
+    - GHC_TARBALL=$(nix run -f ./ci -c discover_tarball.sh)
   variables:
-    GHC_TARBALL: "https://gitlab.haskell.org/api/v4/projects/1/jobs/artifacts/master/raw/ghc-x86_64-linux-fedora33-release.tar.xz?job=x86_64-linux-fedora33-release"
+    UPSTREAM_BRANCH_NAME: master
     EXTRA_HC_OPTS: "-dcore-lint"
   rules:
     - if: '$UPSTREAM_COMMIT_SHA || $UPSTREAM_PIPELINE_ID'
@@ -137,8 +136,10 @@ test-9.2:
 # Build against the 9.4 branch
 .build-9.4:
   extends: .build
+  before_script:
+    - GHC_TARBALL=$(nix run -f ./ci -c discover_tarball.sh)
   variables:
-    GHC_TARBALL: "https://gitlab.haskell.org/api/v4/projects/1/jobs/artifacts/ghc-9.4/raw/ghc-x86_64-linux-fedora33-release.tar.xz?job=release-x86_64-linux-fedora33-release"
+    UPSTREAM_BRANCH_NAME: ghc-9.4
     EXTRA_HC_OPTS: "-dcore-lint"
   rules:
     - if: '$UPSTREAM_COMMIT_SHA || $UPSTREAM_PIPELINE_ID'
diff --git a/ci/default.nix b/ci/default.nix
index 0e3da76773a54bbe000336d62ab95660ee65eff4..8cd997602ce62ae65a7151a9c0998f283b504fcd 100644
--- a/ci/default.nix
+++ b/ci/default.nix
@@ -78,6 +78,9 @@ let
         makeWrapper ${./find-job.sh} $out/bin/find-job \
             --prefix PATH : ${lib.makeBinPath deps}:$out/bin
 
+        makeWrapper ${./find-latest-job.sh} $out/bin/find-latest-job \
+            --prefix PATH : ${lib.makeBinPath deps}:$out/bin
+
         makeWrapper ${xz}/bin/xz $out/bin/xz
         makeWrapper ${curl}/bin/curl $out/bin/curl
       '';
diff --git a/ci/discover_tarball.sh b/ci/discover_tarball.sh
index fe0eaee69c1722aa07b567453f9e3fa36c4b1cb3..2b778805c4a7b398b4c9fe470dadb4fc8ed49c64 100755
--- a/ci/discover_tarball.sh
+++ b/ci/discover_tarball.sh
@@ -6,15 +6,30 @@ cd "$(dirname "${BASH_SOURCE[0]}")"
 
 >&2 echo "NIGHTLY=${NIGHTLY}"
 >&2 echo "RELEASE_JOB=${RELEASE_JOB}"
+>&2 echo "SLOW_VALIDATE=${SLOW_VALIDATE}"
 
-if [ -n "$NIGHTLY" ]; then
-  JOB_NAME="nightly-x86_64-linux-fedora33-release"
-elif [ "$RELEASE_JOB" == "yes" ]; then
-  JOB_NAME="release-x86_64-linux-fedora33-release"
+if [ -n "$SLOW_VALIDATE" ]; then
+  BINDIST_NAME="ghc-x86_64-linux-deb10-numa-slow-validate.tar.xz"
+  if [ -n "$NIGHTLY" ]; then
+    JOB_NAME="nightly-x86_64-linux-deb10-numa-slow-validate"
+  elif [ "$RELEASE_JOB" == "yes" ]; then
+    echo "No slow validate build in release job"
+    exit 2
+  else
+    JOB_NAME="x86_64-linux-deb10-numa-slow-validate"
+  fi
 else
-  JOB_NAME="x86_64-linux-fedora33-release"
+  BINDIST_NAME="ghc-x86_64-linux-fedora33-release.tar.xz"
+  if [ -n "$NIGHTLY" ]; then
+    JOB_NAME="nightly-x86_64-linux-fedora33-release"
+  elif [ "$RELEASE_JOB" == "yes" ]; then
+    JOB_NAME="release-x86_64-linux-fedora33-release"
+  else
+    JOB_NAME="x86_64-linux-fedora33-release"
+  fi
 fi
 
+>&2 echo "BINDIST_NAME=${BINDIST_NAME}"
 >&2 echo "JOB_NAME=${JOB_NAME}"
 
 if [ -n "$UPSTREAM_COMMIT_SHA" ]; then
@@ -24,11 +39,17 @@ if [ -n "$UPSTREAM_COMMIT_SHA" ]; then
   # not the case for GHC pipelines. Consequently, in this case we will
   # usually rather provide UPSTREAM_PIPELINE_ID.
   >&2 echo "Pulling binary distribution from commit $UPSTREAM_COMMIT_SHA of project $UPSTREAM_PROJECT_PATH..."
-  GHC_TARBALL="https://gitlab.haskell.org/$UPSTREAM_PROJECT_PATH/-/jobs/artifacts/$UPSTREAM_COMMIT_SHA/raw/ghc-x86_64-linux-fedora33-release.tar.xz?job=$JOB_NAME"
+  GHC_TARBALL="https://gitlab.haskell.org/$UPSTREAM_PROJECT_PATH/-/jobs/artifacts/$UPSTREAM_COMMIT_SHA/raw/$BINDIST_NAME?job=$JOB_NAME"
 elif [ -n "$UPSTREAM_PIPELINE_ID" ]; then
   job_name=$JOB_NAME
   >&2 echo "Pulling ${job_name} binary distribution from Pipeline $UPSTREAM_PIPELINE_ID..."
   job_id=$(find-job $UPSTREAM_PROJECT_ID $UPSTREAM_PIPELINE_ID $job_name)
   >&2 echo "Using job $job_id..."
-  echo "https://gitlab.haskell.org/$UPSTREAM_PROJECT_PATH/-/jobs/$job_id/artifacts/raw/ghc-x86_64-linux-fedora33-release.tar.xz"
+  echo "https://gitlab.haskell.org/$UPSTREAM_PROJECT_PATH/-/jobs/$job_id/artifacts/raw/$BINDIST_NAME"
+elif [ -n "$UPSTREAM_BRANCH_NAME" ]; then
+  job_name=$JOB_NAME
+  >&2 echo "Finding ${job_name} binary distribution from $UPSTREAM_BRANCH_NAME..."
+  job_id=$(find-latest-job "$UPSTREAM_PROJECT_ID" "$UPSTREAM_BRANCH_NAME" "$JOB_NAME")
+  >&2 echo "Using job $job_id..."
+  echo "https://gitlab.haskell.org/$UPSTREAM_PROJECT_PATH/-/jobs/$job_id/artifacts/raw/$BINDIST_NAME"
 fi
diff --git a/ci/find-latest-job.sh b/ci/find-latest-job.sh
new file mode 100755
index 0000000000000000000000000000000000000000..e31db89759bf72ea62655e019227dfa017e24246
--- /dev/null
+++ b/ci/find-latest-job.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+set -e
+
+project_id=$1
+branch_name=$2
+job_name=$3
+
+resp=$(mktemp)
+
+# Access token is a protected environment variable in the head.hackage project and
+# is necessary for this query to succeed. Sadly job tokens only seem to
+# give us access to the project being built.
+curl \
+  --silent --show-error \
+  -H "Private-Token: $ACCESS_TOKEN" \
+  "https://gitlab.haskell.org/api/v4/projects/$project_id/pipelines/?ref=$branch_name&scope=finished" \
+  > "$resp"
+
+job_ids=$(jq ". | map(.id) " < "$resp")
+if [ "$job_ids" = "null" ]; then
+  echo "Error finding job $job_name for $pipeline_id in project $project_id:" >&2
+  cat "$resp" >&2
+  rm "$resp"
+  exit 1
+else
+  for i in $(echo $job_ids | jq '.[]'); do
+    if find-job $project_id $i $job_name; then
+      exit 0
+    fi
+  done
+  echo "Error finding job $job_name for $branch_name project $project_id:" >&2
+  exit 1
+fi