diff --git a/.github/workflows/binaries-mac-arm64.yml b/.github/workflows/binaries-mac-arm64.yml
new file mode 100644
index 000000000000..9d06f8e37638
--- /dev/null
+++ b/.github/workflows/binaries-mac-arm64.yml
@@ -0,0 +1,223 @@
+# Runs on any push to ci-mac.
+# Produces optimised mac arm64 binaries and runs unit/doc/functional tests,
+# using the default stack.yaml's GHC version.
+
+name: binaries-mac-arm64
+
+on:
+  # Avoid, because these run in all forks also.
+  # jobs:
+  #   job_id:
+  #     if: github.event.pull_request.head.repo.full_name == github.repository
+  # schedule:
+  # - cron: "0 07 * * 0"  # sunday midnight pacific
+
+  push:
+    branches: [ binaries-mac-arm64, binaries ]
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: macos-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        plan:
+        # - { ghc: "810" , stack: "stack --stack-yaml=stack8.10.yaml" }
+        # XXX func tests in bin should be run only with GHC 8.10 for now (see shelltest below) (?)
+        # - { ghc: "90" , stack: "stack --stack-yaml=stack9.0.yaml" }
+        # - { ghc: "92" , stack: "stack --stack-yaml=stack9.2.yaml" }
+        # - { ghc: "94" , stack: "stack --stack-yaml=stack9.4.yaml" }
+        # - { ghc: "96" , stack: "stack --stack-yaml=stack9.6.yaml" }
+        - { ghc: "98" , stack: "stack --stack-yaml=stack.yaml" }
+
+    steps:
+
+    - name: Check out
+      uses: actions/checkout@v3
+      # have to fetch everything for git describe for --version
+      with: 
+        fetch-depth: 0        
+
+    - name: Confirm all remaining steps should run
+      run: echo "CONTINUE=true" >> $GITHUB_ENV
+
+    - name: Check embedded files
+      run: |
+        brew install ripgrep
+        tools/checkembeddedfiles
+      if: env.CONTINUE
+
+    # things to be cached/restored:
+
+    - name: Uncache stack global package db
+      id:   stack-global
+      uses: actions/cache@v3
+      with:
+        path: ~/.stack
+        key: ${{ runner.os }}-stack-global-from20220817-${{ hashFiles('**.yaml') }}
+        restore-keys: |
+             ${{ runner.os }}-stack-global-from20220817
+      if: env.CONTINUE
+
+    - name: Uncache stack-installed programs in ~/.local/bin
+      id:   stack-programs
+      uses: actions/cache@v3
+      with:
+        path: ~/.local/bin
+        key: ${{ runner.os }}-stack-programs-from20220817-${{ hashFiles('**.yaml') }}
+        restore-keys: |
+             ${{ runner.os }}-stack-programs-from20220817
+      if: env.CONTINUE
+
+    - name: Uncache .stack-work
+      uses: actions/cache@v3
+      with:
+        path: .stack-work
+        key: ${{ runner.os }}-stack-work-from20220817-${{ hashFiles('**.yaml') }}
+        restore-keys: |
+             ${{ runner.os }}-stack-work-from20220817
+      if: env.CONTINUE
+
+    - name: Uncache hledger-lib/.stack-work
+      uses: actions/cache@v3
+      with:
+        path: hledger-lib/.stack-work
+        key: ${{ runner.os }}-hledger-lib-stack-work-from20220817-${{ hashFiles('hledger-lib/package.yaml') }}
+        restore-keys: |
+             ${{ runner.os }}-hledger-lib-stack-work-from20220817
+      if: env.CONTINUE
+
+    - name: Uncache hledger/.stack-work
+      uses: actions/cache@v3
+      with:
+        path: hledger/.stack-work
+        key: ${{ runner.os }}-hledger-stack-work-from20220817-${{ hashFiles('hledger/package.yaml') }}
+        restore-keys: |
+             ${{ runner.os }}-hledger-stack-work-from20220817
+      if: env.CONTINUE
+
+    - name: Uncache hledger-ui/.stack-work
+      uses: actions/cache@v3
+      with:
+        path: hledger-ui/.stack-work
+        key: ${{ runner.os }}-hledger-ui-stack-work-from20220817-${{ hashFiles('hledger-ui/package.yaml') }}
+        restore-keys: |
+             ${{ runner.os }}-hledger-ui-stack-work-from20220817
+      if: env.CONTINUE
+
+    - name: Uncache hledger-web/.stack-work
+      uses: actions/cache@v3
+      with:
+        path: hledger-web/.stack-work
+        key: ${{ runner.os }}-hledger-web-stack-work-from20220817-${{ hashFiles('hledger-web/package.yaml') }}
+        restore-keys: |
+             ${{ runner.os }}-hledger-web-stack-work-from20220817
+      if: env.CONTINUE
+
+    # actions:
+
+    - name: Install stack
+      # run: |
+      #   brew install haskell-stack
+      #   $stack --version
+      run: |
+        mkdir -p ~/.local/bin
+        export PATH=~/.local/bin:$PATH        
+        # brew install gnu-tar; curl -sL https://get.haskellstack.org/stable/osx-x86_64.tar.gz | gtar xz --wildcards --strip-components=1 -C ~/.local/bin '*/stack'; chmod a+x ~/.local/bin/stack
+        if [[ ! -x ~/.local/bin/stack ]]; then brew install gnu-tar; curl -sL https://get.haskellstack.org/stable/osx-x86_64.tar.gz | gtar xz --wildcards --strip-components=1 -C ~/.local/bin '*/stack'; chmod a+x ~/.local/bin/stack; fi
+        stack --version
+      if: env.CONTINUE
+
+    - name: Install GHC (with stack)
+      env:
+        stack: ${{ matrix.plan.stack }}
+      run: |
+        $stack setup --install-ghc
+      if: env.CONTINUE
+
+    # - name: Install GHC (with ghcup)
+    #   run: |
+    #     mkdir -p ~/.ghcup/bin && curl -sL https://downloads.haskell.org/~ghcup/x86_64-apple-darwin-ghcup > ~/.ghcup/bin/ghcup && chmod +x ~/.ghcup/bin/ghcup
+    #     ~/.ghcup/bin/ghcup install --set ghc 9.2.4  # && ~/.ghcup/bin/ghcup install stack
+    #     echo "$HOME/.ghcup/bin/" >> $GITHUB_PATH
+    #   if: env.CONTINUE
+
+    # - name: Install GHC (from haskell.org)
+    #   run: |
+    #     curl -sL https://downloads.haskell.org/~ghc/9.2.4/ghc-9.2.4-x86_64-apple-darwin.tar.xz | tar xj && cd ghc-9.2.4-x86_64-apple-darwin && ./configure && make install
+    #     ghc --version
+    #     mkdir -p ~/.stack && printf "system-ghc: true\ninstall-ghc: false\n" >>~/.stack/config.yaml
+    #   if: env.CONTINUE
+
+    - name: Install haskell deps
+      env:
+        stack: ${{ matrix.plan.stack }}
+      run: |
+        $stack build --test --only-dependencies --dry-run
+        $stack build --test --only-dependencies
+      if: env.CONTINUE
+
+    - name: Build hledger and test unit tests, doc tests
+      env:
+        stack: ${{ matrix.plan.stack }}
+      run: |
+        $stack install --test --force-dirty --ghc-options=-fforce-recomp --ghc-options=-Werror
+        # --ghc-options=-split-sections doesn't work on mac
+        #  --pedantic
+      if: env.CONTINUE
+
+    - name: Install shelltestrunner
+      env:
+        stack: ${{ matrix.plan.stack }}
+      run: |
+        export PATH=~/.local/bin:$PATH
+        if [[ ! -x ~/.local/bin/shelltest ]]; then $stack install shelltestrunner-1.10; fi
+        shelltest --version
+      if: env.CONTINUE
+
+    - name: Test functional tests (excluding addons)
+      env:
+        stack: ${{ matrix.plan.stack }}
+      run: |
+        export PATH=~/.local/bin:$PATH
+        COLUMNS=80 $stack exec -- shelltest --execdir -j16 hledger/test -x /_ -x /addons -x ledger-compat/ledger-baseline -x ledger-compat/ledger-regress -x ledger-compat/ledger-collected # bin
+      if: env.CONTINUE
+
+    # This is tested here rather than in the regular CI because it's slow,
+    # doesn't fail too often, and the cost of late detection and fixing is low.
+    - name: Test haddock generation
+      env:
+        stack: ${{ matrix.plan.stack }}
+      run: |
+        printf "haddock version: "; haddock --version
+        time $stack build --fast --haddock --no-haddock-deps --no-haddock-hyperlink-source --haddock-arguments="--no-print-missing-docs"
+        # --no-haddock-hyperlink-source is 25% faster
+        # --no-print-missing-docs is 600% quieter
+      if: env.CONTINUE
+
+    # artifacts:
+
+    - name: Gather binaries
+      run: |
+        mkdir tmp
+        cd tmp
+        cp ~/.local/bin/hledger .
+        cp ~/.local/bin/hledger-ui .
+        cp ~/.local/bin/hledger-web .
+        strip hledger
+        strip hledger-ui
+        strip hledger-web
+        tar cvf hledger-mac-x64.tar hledger hledger-ui hledger-web
+      if: env.CONTINUE
+
+    # upload-artifact loses execute permissions, so we tar the binaries to preserve them.
+    # github UI always zips artifacts when they are downloaded, so we don't bother compressing the tar.
+    # Unfortunately it means users must both unzip and untar.
+    - name: Upload binaries artifact
+      uses: actions/upload-artifact@v3
+      with:
+        name: hledger-mac-x64
+        path: tmp/hledger-mac-x64.tar
+      if: env.CONTINUE
+
diff --git a/.github/workflows/binaries-mac-x64.yml b/.github/workflows/binaries-mac-x64.yml
index e08bb44b6548..b105914b384d 100644
--- a/.github/workflows/binaries-mac-x64.yml
+++ b/.github/workflows/binaries-mac-x64.yml
@@ -1,5 +1,5 @@
 # Runs on any push to ci-mac.
-# Produces optimised mac binaries and runs unit/doc/functional tests,
+# Produces optimised mac x64 binaries and runs unit/doc/functional tests,
 # using the default stack.yaml's GHC version.
 
 name: binaries-mac-x64
@@ -18,7 +18,7 @@ on:
 
 jobs:
   build:
-    runs-on: macos-latest
+    runs-on: macos-13
     strategy:
       fail-fast: false
       matrix: