diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 91369b4d8404d33b10c754cc159385c5e53d0b2a..e9246ce008c08ec131262bbf385c54000ef77a88 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -9,7 +9,7 @@
     if [[ $CI_COMMIT_BRANCH == "master" ]]; then
       export CI_APP_TAG=${CI_APP_TAG:-latest}
     elif [[ $CI_COMMIT_BRANCH == "freeze-version" ]]; then
-      export CI_APP_TAG=${CI_APP_TAG:-9.0.1}
+      export CI_APP_TAG=${CI_APP_TAG:-9.0.2}
     else
       export CI_APP_TAG=${CI_APP_TAG:-$CI_COMMIT_SHA}
     fi
@@ -87,7 +87,7 @@ build:version-linux-amd64:
   rules:
     - if: $CI_COMMIT_BRANCH == "freeze-version" && $CI_BUILD_PLATFORMS =~ /(linux\/amd64)/
       changes:
-        - 9.0.1.Dockerfile
+        - 9.0.2.Dockerfile
 
 build:version-linux-arm64v8:
   extends: .build
@@ -102,7 +102,7 @@ build:version-linux-arm64v8:
   rules:
     - if: $CI_COMMIT_BRANCH == "freeze-version" && $CI_BUILD_PLATFORMS =~ /(linux\/arm64\/v8)/
       changes:
-        - 9.0.1.Dockerfile
+        - 9.0.2.Dockerfile
 
 build-manifest:latest-linux-multiarch:
   extends: .build
@@ -160,7 +160,14 @@ build-manifest:version-linux-multiarch:
           $CI_APP_REPO:$CI_APP_TAG-linux-arm64v8
       fi
       docker manifest push $CI_APP_REPO:$CI_APP_TAG
+    - |
+      docker manifest create $CI_APP_REPO:$VERSION_MAJ_MIN $CI_MANIFEST_LIST
+      if echo $OS_ARCH | grep "linux-arm64v8" >/dev/null ; then
+        docker manifest annotate --variant v8 $CI_APP_REPO:$VERSION_MAJ_MIN \
+          $CI_APP_REPO:$CI_APP_TAG-linux-arm64v8
+      fi
+      docker manifest push $CI_APP_REPO:$VERSION_MAJ_MIN
   rules:
     - if: $CI_COMMIT_BRANCH == "freeze-version"
       changes:
-        - 9.0.1.Dockerfile
+        - 9.0.2.Dockerfile
diff --git a/9.0.2.Dockerfile b/9.0.2.Dockerfile
new file mode 100644
index 0000000000000000000000000000000000000000..8b70d40a8fa35c5918d8ded0b614ca3d87132af7
--- /dev/null
+++ b/9.0.2.Dockerfile
@@ -0,0 +1,126 @@
+ARG GHC_VERSION_BUILD
+ARG CABAL_VERSION_BUILD
+
+FROM registry.gitlab.b-data.ch/ghc/ghc4pandoc:8.10.7 as bootstrap
+
+ENV GHC_VERSION=${GHC_VERSION_BUILD:-9.0.2}
+ENV CABAL_VERSION=${CABAL_VERSION_BUILD:-3.4.0.0}
+
+RUN apk add --update --no-cache \
+    autoconf \
+    automake \
+    binutils-gold \
+    build-base \
+    coreutils \
+    cpio \
+    curl \
+    gnupg \
+    linux-headers \
+    libffi-dev \
+    ncurses-dev \
+    perl \
+    python3 \
+    xz \
+    zlib-dev
+
+RUN cd /tmp \
+  && curl -sSLO https://downloads.haskell.org/~ghc/$GHC_VERSION/ghc-$GHC_VERSION-src.tar.xz \
+  && curl -sSLO https://downloads.haskell.org/~ghc/$GHC_VERSION/ghc-$GHC_VERSION-src.tar.xz.sig \
+  && gpg --keyserver hkps://keyserver.ubuntu.com:443 \
+    --receive-keys 88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4 \
+  && gpg --verify ghc-$GHC_VERSION-src.tar.xz.sig ghc-$GHC_VERSION-src.tar.xz \
+  && tar xf ghc-$GHC_VERSION-src.tar.xz \
+  && cd ghc-$GHC_VERSION \
+  # Set llvm version to 10
+  && sed -i -e 's/LlvmVersion=9/LlvmVersion=10/g' configure.ac \
+  && cp mk/build.mk.sample mk/build.mk \
+  && echo 'BuildFlavour=perf-llvm' >> mk/build.mk \
+  && echo 'BeConservative=YES' >> mk/build.mk \
+  && echo 'SplitSections=YES' >> mk/build.mk \
+  && echo 'HADDOCK_DOCS=NO' >> mk/build.mk \
+  && echo 'HSCOLOUR_SRCS=NO' >> mk/build.mk \
+  && echo 'BUILD_SPHINX_HTML=NO' >> mk/build.mk \
+  && echo 'BUILD_SPHINX_PS=NO' >> mk/build.mk \
+  && echo 'BUILD_SPHINX_PDF=NO' >> mk/build.mk \
+  && autoreconf \
+  && ./configure --disable-ld-override LD=ld.gold \
+  # Switch llvm-targets from unknown-linux-gnueabihf->alpine-linux
+  # so we can match the llvm vendor string alpine uses
+  && sed -i -e 's/unknown-linux-gnueabihf/alpine-linux/g' llvm-targets \
+  && sed -i -e 's/unknown-linux-gnueabi/alpine-linux/g' llvm-targets \
+  && sed -i -e 's/unknown-linux-gnu/alpine-linux/g' llvm-targets \
+  # See https://unix.stackexchange.com/questions/519092/what-is-the-logic-of-using-nproc-1-in-make-command
+  && make -j$((`nproc`+1)) \
+  && make binary-dist \
+  && cabal update \
+  # See https://gitlab.haskell.org/ghc/ghc/-/wikis/commentary/libraries/version-history
+  && cabal install cabal-install-$CABAL_VERSION
+
+FROM alpine:3.15 as builder
+
+LABEL org.label-schema.license="MIT" \
+      org.label-schema.vcs-url="https://gitlab.b-data.ch/ghc/ghc4pandoc" \
+      maintainer="Olivier Benz <olivier.benz@b-data.ch>"
+
+ENV GHC_VERSION=${GHC_VERSION_BUILD:-9.0.2}
+ENV CABAL_VERSION=${CABAL_VERSION_BUILD:-3.4.0.0}
+ENV PATH=$PATH:/usr/lib/llvm10/bin
+
+RUN apk add --update --no-cache \
+    bash \
+    build-base \
+    bzip2 \
+    bzip2-dev \
+    bzip2-static \
+    curl \
+    curl-static \
+    dpkg \
+    fakeroot \
+    git \
+    gmp-dev \
+    libcurl \
+    libffi \
+    libffi-dev \
+    llvm10 \
+    ncurses-dev \
+    ncurses-static \
+    openssl-dev \
+    openssl-libs-static \
+    pcre \
+    pcre-dev \
+    pcre2 \
+    pcre2-dev \
+    perl \
+    wget \
+    xz \
+    xz-dev \
+    zlib \
+    zlib-dev \
+    zlib-static
+
+COPY --from=bootstrap /tmp/ghc-$GHC_VERSION/ghc-$GHC_VERSION-*-alpine-linux.tar.xz /tmp/
+COPY --from=bootstrap /root/.cabal/bin/cabal /usr/bin/cabal
+
+RUN cd /tmp \
+  && tar -xJf ghc-$GHC_VERSION-*-alpine-linux.tar.xz \
+  && cd ghc-$GHC_VERSION \
+  && ./configure --disable-ld-override --prefix=/usr \
+  && make install \
+  && cd / \
+  && rm -rf /tmp/*
+
+FROM builder as tester
+
+COPY Main.hs Main.hs
+
+RUN ghc -static -optl-pthread -optl-static Main.hs \
+  && file Main \
+  && ./Main \
+  # Test cabal workflow
+  && mkdir cabal-test \
+  && cd cabal-test \
+  && cabal update \
+  && cabal init -n --is-executable -p tester -l MIT \
+  && cabal run
+
+FROM builder as final