diff --git a/Bosch-CA-DE.crt b/Bosch-CA-DE.crt
new file mode 100644
index 00000000..37e01fba
--- /dev/null
+++ b/Bosch-CA-DE.crt
@@ -0,0 +1,57 @@
+-----BEGIN CERTIFICATE-----
+MIIEtzCCA5+gAwIBAgIEQwHQujANBgkqhkiG9w0BAQsFADBQMRMwEQYKCZImiZPy
+LGQBGRYDY29tMRUwEwYKCZImiZPyLGQBGRYFQm9zY2gxDDAKBgNVBAMTA1BLSTEU
+MBIGA1UEAxMLQm9zY2gtQ0EtREUwHhcNMTUwNTEyMDk0ODEwWhcNMjUwNTEyMTAx
+ODEwWjBRMRMwEQYKCZImiZPyLGQBGRYDY29tMRUwEwYKCZImiZPyLGQBGRYFQm9z
+Y2gxDDAKBgNVBAMTA1BLSTEVMBMGA1UEAxMMQm9zY2gtQ0ExLURFMIIBIjANBgkq
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoCSMNJfVszQGGIlreOUP8OJb6yE/zj38
+G3JAqUvuj4t92nUZmtblwd2WDqSzhfyB3fOWlgL4l5Z3VyVR/YEEeUkrI4dHZxo4
+ydKw2xsNhD3zg7zh2dZLx7HYmLD6P7A1O0KAvc6G4ZPEwhaVZ86G2XMy/Pd2qq0y
+lpierOhhv+35TPOODxbT8p0IzrTszqJzaOmCHPWyvmP03mpgX8RNBZCc2g90DOiG
+zRuTZbTbBXJrJWNJUNUrpw8CcGdXNoW/7U1XmazncyWZCSBKDtKRGzXHAqyDkxI6
+wMMv52f1uL1RTVpg1cVN59QRwdROyOmTtERX41CjvY73sl9Qo4q3XwIDAQABo4IB
+ljCCAZIwggEYBgNVHR8EggEPMIIBCzBnoGWgY6RhMF8xEzARBgoJkiaJk/IsZAEZ
+FgNjb20xFTATBgoJkiaJk/IsZAEZFgVCb3NjaDEMMAoGA1UEAxMDUEtJMRQwEgYD
+VQQDEwtCb3NjaC1DQS1ERTENMAsGA1UEAxMEQ1JMMTCBn6CBnKCBmYZVbGRhcDov
+L2Jvc2NoLmNvbS9jbj1Cb3NjaC1DQS1ERSxjbj1QS0ksZGM9Qm9zY2gsZGM9Y29t
+P2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q/YmFzZYZAaHR0cDovL3RydXN0Y2Vu
+dGVyLmJvc2NoLmNvbS9DUkwvYm9zY2gtY2EtZGVfcGtpX2NvbV9jcmxmaWxlLmNy
+bDALBgNVHQ8EBAMCAQYwHwYDVR0jBBgwFoAUHqU/IqIIIRvFWCjRHy3w8/j5FSkw
+HQYDVR0OBBYEFN4E4syJCP11jNikMDHYEG3lofSbMAwGA1UdEwQFMAMBAf8wGQYJ
+KoZIhvZ9B0EABAwwChsEVjguMQMCAIEwDQYJKoZIhvcNAQELBQADggEBAEhM5mk5
+bcNMPvYrtYOrlmHl4d/N6DgULfENn2ePhuz45sXH7Miex2KxiXJyPmuWwyMOtL6E
+0oEI9Wwv8nIiB6VNvt8deSXmbaJ+yqfC/RhHtOTnT2igd1VdMuZlXgCPJ5dSYpde
+H5CQr0OIeFTqwt2Q96PiAGiV6aoPRJWvN3sX5mocC+BxC1xExVz6uQAOsLanK0P3
+RemoOXYjlF2c1J9WmjsWw/nMdrI0EgGIcGGZU+GAxQKOPE0a4wZMLvgCqoBOsAoj
+fMQANsGiiE6VoeZ+e6sYcdTbUgCBdhjPi+eCpqlhaJOjZ1E+6qFpkM2ni1eEFjOq
+6cBhN9cvOjqptek=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIE+jCCA+KgAwIBAgIEQwG2sjANBgkqhkiG9w0BAQUFADBQMRMwEQYKCZImiZPy
+LGQBGRYDY29tMRUwEwYKCZImiZPyLGQBGRYFQm9zY2gxDDAKBgNVBAMTA1BLSTEU
+MBIGA1UEAxMLQm9zY2gtQ0EtREUwHhcNMDUwODE2MDkxOTQyWhcNMjUwODE2MDk0
+OTQyWjBQMRMwEQYKCZImiZPyLGQBGRYDY29tMRUwEwYKCZImiZPyLGQBGRYFQm9z
+Y2gxDDAKBgNVBAMTA1BLSTEUMBIGA1UEAxMLQm9zY2gtQ0EtREUwggEiMA0GCSqG
+SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDADDavsLqpxKnP+mABiNavAOpR8EK4o7E1
+NxRj//V6gVHdLw9EnRY+CeX6KAf6CjW3X+VRzQMZOMxcj4Hn9T2/hvApgjr4asLH
+duTYlNlSPBLH1c0rDBJRj4SllBtkHx4g7eelVWzWT4k2vIgxNtwAR0x+dghgObQB
+MGnPYGsERYQ62JU4c3Z3yNVOOCtSh+3J9m+8zMSvPKKpiqK4D5QfhMjJDvOAgJRz
+kQLnJHTATLhF5Jp0phWUHJGeChwoncbhYX13AnEpqccGrid+ZdKYIFDs/I8t505V
+TzvQ8O0yMkYc1RLIfXMsDeullW+00lmlFylcqXXMStOMhyYii4XXAgMBAAGjggHa
+MIIB1jARBglghkgBhvhCAQEEBAMCAAcwggEYBgNVHR8EggEPMIIBCzBnoGWgY6Rh
+MF8xEzARBgoJkiaJk/IsZAEZFgNjb20xFTATBgoJkiaJk/IsZAEZFgVCb3NjaDEM
+MAoGA1UEAxMDUEtJMRQwEgYDVQQDEwtCb3NjaC1DQS1ERTENMAsGA1UEAxMEQ1JM
+MTCBn6CBnKCBmYZVbGRhcDovL2Jvc2NoLmNvbS9jbj1Cb3NjaC1DQS1ERSxjbj1Q
+S0ksZGM9Qm9zY2gsZGM9Y29tP2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q/YmFz
+ZYZAaHR0cDovL3RydXN0Y2VudGVyLmJvc2NoLmNvbS9DUkwvYm9zY2gtY2EtZGVf
+cGtpX2NvbV9jcmxmaWxlLmNybDArBgNVHRAEJDAigA8yMDA1MDgxNjA5MTk0MlqB
+DzIwMjUwODE2MDk0OTQyWjALBgNVHQ8EBAMCAQYwHwYDVR0jBBgwFoAUHqU/IqII
+IRvFWCjRHy3w8/j5FSkwHQYDVR0OBBYEFB6lPyKiCCEbxVgo0R8t8PP4+RUpMAwG
+A1UdEwQFMAMBAf8wHQYJKoZIhvZ9B0EABBAwDhsIVjcuMTo0LjADAgSQMA0GCSqG
+SIb3DQEBBQUAA4IBAQBkQ/eOR9L4eenoIddXw7SjnJDnfsgZIaJNsnJ8afxgJjvo
+t/U6AjnmPo7Waa5gyEIS9EEEmAubTwU30NyhHCr8iHjFDWhbSa9Waajb81i6Wgkl
+pjM6T1D+RuEO1Ty6sWgPsfx3bZLITQyoXr33nRokVmKshjwtEU05BKRXgvk7ma9H
+GCV1lOtwdjHKcK17mE2FHGbFNm/o6P9CkN4P3jdmpWKSb7915Cz9wdNPOl0IBcSl
+wH7j3D8YEfbkrDkk2UYPccZUzMkPi6+WhlUmwkc0ea+Fa+pjGBsZ7AEfRCcVZaz3
+fjluyBWjuWRa5bY3P86UdjQplcobWrovoIwehkyR
+-----END CERTIFICATE-----
diff --git a/Dockerfile b/Dockerfile
index 3f3cc4d3..9c91e4c3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,8 @@
 FROM fpco/pid1:22.04
 
+# Add Bosch CA certificate
+COPY Bosch-CA-DE.crt /usr/local/share/ca-certificates/Bosch-CA-DE.crt
+
 ENV HOME /home/stackage
 ENV LANG en_US.UTF-8
 # ENV GHCVER 9.4.3
diff --git a/automated/build.sh b/automated/build.sh
index b134f8f7..aac4d960 100755
--- a/automated/build.sh
+++ b/automated/build.sh
@@ -5,7 +5,7 @@ set -eu +x -o pipefail
 ROOT=$(cd $(dirname $0) ; pwd)
 TARGET=$1
 
-source work/aws.sh
+#source work/aws.sh
 
 # For nightly-YYYY-MM-DD, tag should be nightly
 # For lts-X.Y, tag should be ltsX
@@ -19,8 +19,8 @@ else
     WORKDIR=$ROOT/work/$TAG
 fi
 
-#IMAGE=commercialhaskell/stackage:$TAG
-IMAGE=ghcr.io/commercialhaskell/stackage/build:$TAG
+IMAGE=commercialhaskell/stackage:$TAG
+#IMAGE=ghcr.io/commercialhaskell/stackage/build:$TAG
 
 PANTRY_DIR=$ROOT/work/stack/pantry
 STACK_DIR=$ROOT/work/stack
@@ -55,22 +55,22 @@ function require_400_file {
     chmod 400 "$1"
 }
 
-require_400_file "$SSH_DIR/id_rsa"
-require_400_file "$HACKAGE_CREDS"
+#require_400_file "$SSH_DIR/id_rsa"
+#require_400_file "$HACKAGE_CREDS"
 
 mkdir -p $ROOT/work/bin
 BINDIR=$(cd $ROOT/work/bin ; pwd)
 (
 cd $BINDIR
-rm -f curator stack *.bz2
+#rm -f curator stack *.bz2
 
-curl -L "https://github.com/commercialhaskell/curator/releases/download/commit-4ae7a59717f163e15c69ddf75d31d0f775de2561/curator.bz2" | bunzip2 > curator
-chmod +x curator
+#curl -L "https://github.com/commercialhaskell/curator/releases/download/commit-4ae7a59717f163e15c69ddf75d31d0f775de2561/curator.bz2" | bunzip2 > curator
+#chmod +x curator
 echo -n "curator version: "
 docker run --rm -v $(pwd)/curator:/exe $IMAGE /exe --version
 
-curl -L https://github.com/commercialhaskell/stack/releases/download/v2.9.3/stack-2.9.3-linux-x86_64-bin > stack
-chmod +x stack
+#curl -L https://github.com/commercialhaskell/stack/releases/download/v2.9.3/stack-2.9.3-linux-x86_64-bin > stack
+#chmod +x stack
 echo -n "stack version: "
 docker run --rm -v $(pwd)/stack:/exe $IMAGE /exe --version
 )
@@ -83,16 +83,16 @@ ARGS_PREBUILD="$ARGS_COMMON -u $USERID -e HOME=$HOME -v $DOT_STACKAGE_DIR:$HOME/
 ARGS_BUILD="$ARGS_COMMON"
 # instance-data is an undocumented feature of S3 used by amazonka,
 # see https://github.com/brendanhay/amazonka/issues/271
-ARGS_UPLOAD="$ARGS_COMMON -u $USERID -e HOME=$HOME -v $HACKAGE_CREDS:/hackage-creds:ro -v $DOT_STACKAGE_DIR:$HOME/.stackage -v $SSH_DIR:$HOME/.ssh:ro -v $GITCONFIG:$HOME/.gitconfig:ro -e AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY -v $DOT_STACKAGE_DIR:/dot-stackage"
+ARGS_UPLOAD="$ARGS_COMMON -u $USERID -e HOME=$HOME -v $HACKAGE_CREDS:/hackage-creds:ro -v $DOT_STACKAGE_DIR:$HOME/.stackage -v $SSH_DIR:$HOME/.ssh:ro -v $GITCONFIG:$HOME/.gitconfig:ro -v $DOT_STACKAGE_DIR:/dot-stackage"
 
 # Make sure we actually need this snapshot. We only check this for LTS releases
 # since, for nightlies, we'd like to run builds even if they are unnecessary to
 # get early warning information of upcoming failures. (See the duplicate check
 # below for why this is safe.)
-if [ $SHORTNAME = "lts" ]
-then
-  docker run $ARGS_UPLOAD $IMAGE /bin/bash -c "exec curator check-target-available --target $TARGET"
-fi
+#if [ $SHORTNAME = "lts" ]
+#then
+#  docker run $ARGS_UPLOAD $IMAGE /bin/bash -c "exec curator check-target-available --target $TARGET"
+#fi
 
 
 # Determine the new build plan unless NOPLAN is set
@@ -139,25 +139,25 @@ docker run $ARGS_BUILD $IMAGE nice -n 15 /bin/bash -c "chown $USER $HOME && exec
 # nightly, where we don't perform this check beforehand. This is also slightly
 # safer, in case someone else already uploaded a specific snapshot while we
 # were building.
-docker run $ARGS_UPLOAD $IMAGE /bin/bash -c "exec curator check-target-available --target $TARGET"
+#docker run $ARGS_UPLOAD $IMAGE /bin/bash -c "exec curator check-target-available --target $TARGET"
 
 # Successful build, so we need to:
 #
 # * Upload the docs to S3
 # * Upload the new snapshot .yaml file to the appropriate Github repo, also upload its constraints
-docker run $ARGS_UPLOAD $IMAGE /bin/bash -c "curator upload-docs --target $TARGET && curator upload-github --target $TARGET"
+#docker run $ARGS_UPLOAD $IMAGE /bin/bash -c "curator upload-docs --target $TARGET && curator upload-github --target $TARGET"
 
 # fixed in https://github.com/commercialhaskell/curator/pull/24
-docker run $ARGS_UPLOAD $IMAGE /bin/bash -c "exec curator hackage-distro --target $TARGET"
+#docker run $ARGS_UPLOAD $IMAGE /bin/bash -c "exec curator hackage-distro --target $TARGET"
 
 # Build and push docker image fpco/stack-build & fpco/stack-build-small for current release
 
-if [ $SHORTNAME = "lts" ]
-then
-    $ROOT/dockerfiles/build.sh $TARGET
-    $ROOT/dockerfiles/build.sh --push $TARGET
-    $ROOT/dockerfiles/build.sh --push --small $TARGET
-fi
+#if [ $SHORTNAME = "lts" ]
+#then
+#    $ROOT/dockerfiles/build.sh $TARGET
+#    $ROOT/dockerfiles/build.sh --push $TARGET
+#    $ROOT/dockerfiles/build.sh --push --small $TARGET
+#fi
 
 echo -n "Completed at "
 date
diff --git a/build-constraints.yaml b/build-constraints.yaml
index 2b94ef64..41f51844 100644
--- a/build-constraints.yaml
+++ b/build-constraints.yaml
@@ -6348,8 +6348,7 @@ packages:
         - ginger < 0 # tried ginger-0.10.4.0, but its *library* requires bytestring >=0.10.8.2 && < 0.11 and the snapshot contains bytestring-0.11.4.0
         - ginger < 0 # tried ginger-0.10.4.0, but its *library* requires text >=1.2.3.1 && < 1.3 and the snapshot contains text-2.0.2
         - gio < 0 # tried gio-0.13.8.2, but its *library* requires Cabal >=2.0 && < 3.7 and the snapshot contains Cabal-3.8.1.0
-        - git-annex < 0 # tried git-annex-10.20230407, but its *executable* requires the disabled package: bloomfilter
-        - git-annex < 0 # tried git-annex-10.20230407, but its *executable* requires the disabled package: git-lfs
+        - git-annex < 0 # tried git-annex-10.20230407, but its *executable* requires unix-compat (< 0.7 and the snapshot contains unix-compat-0.7
         - git-lfs < 0 # tried git-lfs-1.2.0, but its *library* requires aeson >=1.3 && < 2.1 and the snapshot contains aeson-2.1.2.1
         - git-lfs < 0 # tried git-lfs-1.2.0, but its *library* requires text >=1.2 && < 1.3 and the snapshot contains text-2.0.2
         - github-webhook-handler < 0 # tried github-webhook-handler-0.0.8, but its *library* requires base >=4 && < 4.11 and the snapshot contains base-4.17.1.0
@@ -7359,6 +7358,7 @@ packages:
         - srt-dhall < 0 # tried srt-dhall-0.1.0.0, but its *library* requires text >=1.0 && < 1.3 and the snapshot contains text-2.0.2
         - srt-formatting < 0 # tried srt-formatting-0.1.0.0, but its *library* requires formatting >=7.0.0 && < 7.2 and the snapshot contains formatting-7.2.0
         - stack < 0 # tried stack-2.9.3, but its *library* requires persistent >=2.13.3.5 && < 2.14 and the snapshot contains persistent-2.14.5.0
+        - stack < 0 # tried stack-2.9.3, but its *library* requires unix-compat < 0.7 and the snapshot contains unix-compat-0.7
         - stackcollapse-ghc < 0 # tried stackcollapse-ghc-0.0.1.4, but its *executable* requires base >=4.12.0.0 && < 4.16 and the snapshot contains base-4.17.1.0
         - stm-supply < 0 # tried stm-supply-0.2.0.0, but its *library* requires the disabled package: concurrent-supply
         - streaming-cassava < 0 # tried streaming-cassava-0.2.0.0, but its *library* requires streaming-bytestring ==0.2.* and the snapshot contains streaming-bytestring-0.3.0
@@ -8579,7 +8579,7 @@ expected-test-failures:
     - triplesec
     - turtle
     - type-level-kv-list
-    - tzdata # 0.2.20221028.0 - https://github.com/ysangkok/haskell-tzdata/issues/3
+    - tzdata # 0.2.20230322.0 - https://github.com/ysangkok/haskell-tzdata/issues/3
     - unicode-show
     - universe-some
     - universum
diff --git a/build_image.sh b/build_image.sh
new file mode 100755
index 00000000..2fda0895
--- /dev/null
+++ b/build_image.sh
@@ -0,0 +1 @@
+docker build . -f Dockerfile --tag commercialhaskell/stackage:nightly
diff --git a/commenter b/commenter
index 6fde28e9..0595d150 100755
Binary files a/commenter and b/commenter differ
diff --git a/local_nightly.sh b/local_nightly.sh
new file mode 100755
index 00000000..5a3dacda
--- /dev/null
+++ b/local_nightly.sh
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+cp build-constraints.yaml ./automated/work/nightly
+cd automated
+./build.sh nightly-$(date -u +%F)