diff --git a/.github/workflows/haskell-ci-hackage.patch b/.github/workflows/haskell-ci-hackage.patch
index e7b87029..d36c8aea 100644
--- a/.github/workflows/haskell-ci-hackage.patch
+++ b/.github/workflows/haskell-ci-hackage.patch
@@ -2,14 +2,16 @@ Piggy-back on the haskell-ci workflow for automatic releases to Hackage.
 
 This extends the workflow with two additional triggers:
 
- * When a release is created on GitHub, a candidate release is uploaded to
-   Hackage and docs are submitted for it as Hackage can't build them itself
-   (https://github.com/haskell/hackage-server/issues/925).
+ * When the Haskell-CI workflow is triggered manually with a non-empty version
+   input (matching the version in the cabal file), a candidate release is
+   uploaded to Hackage and docs are submitted for it as Hackage can't build
+   them itself (https://github.com/haskell/hackage-server/issues/925).
 
- * To make a final release, the workflow can be triggered manually by entering
-   the correct version number matching the version in the cabal file. This is
-   here because promoting the candidate on Hackage discards the uploaded docs
-   (https://github.com/haskell/hackage-server/issues/70).
+   Note that promoting the candidate on Hackage discards the uploaded docs
+   (https://github.com/haskell/hackage-server/issues/70). Don't do that.
+
+ * When a release is created on GitHub, a final release is uploaded to Hackage
+   and docs are submitted for it.
 
 The automation uses a special Hackage user: https://hackage.haskell.org/user/xmonad
 and each repo (X11, xmonad, xmonad-contrib) has its own HACKAGE_API_KEY token
@@ -17,7 +19,7 @@ set in GitHub repository secrets.
 
 --- .github/workflows/haskell-ci.yml.orig
 +++ .github/workflows/haskell-ci.yml
-@@ -14,8 +14,17 @@
+@@ -14,8 +14,15 @@
  #
  name: Haskell-CI
  on:
@@ -31,21 +33,19 @@ set in GitHub repository secrets.
 +  workflow_dispatch:
 +    inputs:
 +      version:
-+        # releases to Hackage are final and cannot be reverted, thus require
-+        # manual entry of version as a poor man's mistake avoidance
-+        description: version (must match version in cabal file)
++        description: candidate version (must match version in cabal file)
  jobs:
    linux:
      name: Haskell-CI - Linux - ${{ matrix.compiler }}
-@@ -28,6 +37,7 @@
-         include:
-           - compiler: ghc-9.0.1
+@@ -31,6 +38,7 @@
+             compilerVersion: 9.0.1
+             setup-method: hvr-ppa
              allow-failure: false
 +            upload: true
            - compiler: ghc-8.10.4
-             allow-failure: false
-           - compiler: ghc-8.8.4
-@@ -171,8 +181,66 @@
+             compilerKind: ghc
+             compilerVersion: 8.10.4
+@@ -209,8 +217,66 @@
            ${CABAL} -vnormal check
        - name: haddock
          run: |
@@ -66,7 +66,7 @@ set in GitHub repository secrets.
 +        with:
 +          path: ${{ github.workspace }}/haddock/*-docs.tar.gz
 +      - name: hackage upload (candidate)
-+        if: matrix.upload && github.event_name == 'release'
++        if: matrix.upload && github.event_name == 'workflow_dispatch' && github.event.inputs.version != ''
 +        run: |
 +          set -ex
 +          PACKAGE_VERSION="${PACKAGE_VERSION#v}"
@@ -88,9 +88,9 @@ set in GitHub repository secrets.
 +        env:
 +          HACKAGE_API_KEY: ${{ secrets.HACKAGE_API_KEY }}
 +          PACKAGE_NAME: ${{ github.event.repository.name }}
-+          PACKAGE_VERSION: ${{ github.event.release.tag_name }}
++          PACKAGE_VERSION: ${{ github.event.inputs.version }}
 +      - name: hackage upload (release)
-+        if: matrix.upload && github.event_name == 'workflow_dispatch'
++        if: matrix.upload && github.event_name == 'release'
 +        run: |
 +          set -ex
 +          PACKAGE_VERSION="${PACKAGE_VERSION#v}"
@@ -112,4 +112,4 @@ set in GitHub repository secrets.
 +        env:
 +          HACKAGE_API_KEY: ${{ secrets.HACKAGE_API_KEY }}
 +          PACKAGE_NAME: ${{ github.event.repository.name }}
-+          PACKAGE_VERSION: ${{ github.event.inputs.version }}
++          PACKAGE_VERSION: ${{ github.event.release.tag_name }}
diff --git a/.github/workflows/haskell-ci.yml b/.github/workflows/haskell-ci.yml
index 7c22b122..e8bea4ef 100644
--- a/.github/workflows/haskell-ci.yml
+++ b/.github/workflows/haskell-ci.yml
@@ -22,9 +22,7 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        # releases to Hackage are final and cannot be reverted, thus require
-        # manual entry of version as a poor man's mistake avoidance
-        description: version (must match version in cabal file)
+        description: candidate version (must match version in cabal file)
 jobs:
   linux:
     name: Haskell-CI - Linux - ${{ matrix.compiler }}
@@ -266,7 +264,7 @@ jobs:
         with:
           path: ${{ github.workspace }}/haddock/*-docs.tar.gz
       - name: hackage upload (candidate)
-        if: matrix.upload && github.event_name == 'release'
+        if: matrix.upload && github.event_name == 'workflow_dispatch' && github.event.inputs.version != ''
         run: |
           set -ex
           PACKAGE_VERSION="${PACKAGE_VERSION#v}"
@@ -288,9 +286,9 @@ jobs:
         env:
           HACKAGE_API_KEY: ${{ secrets.HACKAGE_API_KEY }}
           PACKAGE_NAME: ${{ github.event.repository.name }}
-          PACKAGE_VERSION: ${{ github.event.release.tag_name }}
+          PACKAGE_VERSION: ${{ github.event.inputs.version }}
       - name: hackage upload (release)
-        if: matrix.upload && github.event_name == 'workflow_dispatch'
+        if: matrix.upload && github.event_name == 'release'
         run: |
           set -ex
           PACKAGE_VERSION="${PACKAGE_VERSION#v}"
@@ -312,4 +310,4 @@ jobs:
         env:
           HACKAGE_API_KEY: ${{ secrets.HACKAGE_API_KEY }}
           PACKAGE_NAME: ${{ github.event.repository.name }}
-          PACKAGE_VERSION: ${{ github.event.inputs.version }}
+          PACKAGE_VERSION: ${{ github.event.release.tag_name }}