diff --git a/.github/workflows/haskell-ci.yml b/.github/workflows/haskell-ci.yml
index f872bb91..47cf4fb5 100644
--- a/.github/workflows/haskell-ci.yml
+++ b/.github/workflows/haskell-ci.yml
@@ -184,7 +184,8 @@ jobs:
                         26021a13b401500c8eb2761ca95c61f2d625bfef951b939a8124ed12ecf07329
                         f76d08be13e9a61a377a85e2fb63f4c5435d40f8feb3e12eb05905edb8cdea89
              key-threshold: 3
-          active-repositories: hackage.haskell.org, head.hackage.ghc.haskell.org:override
+          # Work around https://github.com/haskell/cabal/issues/6522
+          active-repositories: hackage.haskell.org
           EOF
           fi
           cat >> $CABAL_CONFIG <<EOF
@@ -261,7 +262,8 @@ jobs:
             tag:      730a0ed799c91324d42b70d3780d6b3215cafc3c
           EOF
           if $HEADHACKAGE; then
-          echo "allow-newer: $($HCPKG list --simple-output | sed -E 's/([a-zA-Z-]+)-[0-9.]+/*:\1,/g')" >> cabal.project
+          # Work around https://github.com/haskell/cabal/issues/10500
+          echo "allow-newer: $($HCPKG list --simple-output | xargs -d' ' -n 1 | grep -v "^Cabal" | sed -E 's/([a-zA-Z-]+)-[0-9.]+/allow\-newer\: *:\1/g')" >> cabal.project
           fi
           $HCPKG list --simple-output --names-only | perl -ne 'for (split /\s+/) { print "constraints: any.$_ installed\n" unless /^(Cabal|Cabal-syntax|singletons|singletons-base|singletons-base-code-generator|singletons-th)$/; }' >> cabal.project.local
           cat cabal.project
diff --git a/cabal.haskell-ci b/cabal.haskell-ci
index b9e157b4..23161777 100644
--- a/cabal.haskell-ci
+++ b/cabal.haskell-ci
@@ -6,3 +6,6 @@ jobs-selection:         any
 haddock-components:     libs
 -- Needed to avoid https://github.com/haskell/cabal/issues/9917
 installed:              +all -Cabal -Cabal-syntax
+-- Needed to work around https://github.com/haskell/cabal/issues/6522 and
+-- https://github.com/haskell/cabal/issues/10500
+github-patches:         github.yml.patch
diff --git a/github.yml.patch b/github.yml.patch
new file mode 100644
index 00000000..412bc6ef
--- /dev/null
+++ b/github.yml.patch
@@ -0,0 +1,24 @@
+diff --git a/.github/workflows/haskell-ci.yml b/.github/workflows/haskell-ci.yml
+index f872bb9..47cf4fb 100644
+--- a/.github/workflows/haskell-ci.yml
++++ b/.github/workflows/haskell-ci.yml
+@@ -184,7 +184,8 @@ jobs:
+                         26021a13b401500c8eb2761ca95c61f2d625bfef951b939a8124ed12ecf07329
+                         f76d08be13e9a61a377a85e2fb63f4c5435d40f8feb3e12eb05905edb8cdea89
+              key-threshold: 3
+-          active-repositories: hackage.haskell.org, head.hackage.ghc.haskell.org:override
++          # Work around https://github.com/haskell/cabal/issues/6522
++          active-repositories: hackage.haskell.org
+           EOF
+           fi
+           cat >> $CABAL_CONFIG <<EOF
+@@ -261,7 +262,8 @@ jobs:
+             tag:      730a0ed799c91324d42b70d3780d6b3215cafc3c
+           EOF
+           if $HEADHACKAGE; then
+-          echo "allow-newer: $($HCPKG list --simple-output | sed -E 's/([a-zA-Z-]+)-[0-9.]+/*:\1,/g')" >> cabal.project
++          # Work around https://github.com/haskell/cabal/issues/10500
++          echo "allow-newer: $($HCPKG list --simple-output | xargs -d' ' -n 1 | grep -v "^Cabal" | sed -E 's/([a-zA-Z-]+)-[0-9.]+/allow\-newer\: *:\1/g')" >> cabal.project
+           fi
+           $HCPKG list --simple-output --names-only | perl -ne 'for (split /\s+/) { print "constraints: any.$_ installed\n" unless /^(Cabal|Cabal-syntax|singletons|singletons-base|singletons-base-code-generator|singletons-th)$/; }' >> cabal.project.local
+           cat cabal.project