diff --git a/hackage-server.cabal b/hackage-server.cabal
index ba6b86341..934ac195c 100644
--- a/hackage-server.cabal
+++ b/hackage-server.cabal
@@ -118,6 +118,9 @@ common defaults
   build-depends:
     , aeson                 ^>= 2.0.3.0
     , Cabal                 ^>= 3.6.3.0
+    , Cabal-syntax          ^>= 3.6.0.0
+        -- Cabal-syntax needs to be bound to constrain hackage-security
+        -- see https://github.com/haskell/hackage-server/issues/1130
     , fail                  ^>= 4.9.0
       -- we use Control.Monad.Except, introduced in mtl-2.2.1
     , network               >=  3 && < 3.2
@@ -390,9 +393,14 @@ library lib-server
     , cryptohash-sha256     ^>= 0.11.100
     , csv                   ^>= 0.1
     , ed25519               ^>= 0.0.5
-    , hackage-security      ^>= 0.6
+    , hackage-security       >= 0.6 && < 0.7
+        -- N.B: hackage-security-0.6.2 uses Cabal-syntax-3.8.1.0
+        -- see https://github.com/haskell/hackage-server/issues/1130
+        -- Thus, we need to include Cabal-syntax as dependency explicitly
     , hackage-security-HTTP ^>= 0.1.1
-    , haddock-library       > 1.7 && < 2
+    , haddock-library        >= 1.7.0 && < 1.11
+        -- haddock-library-1.11.0 changed type of markupOrderedList
+        -- see https://github.com/haskell/hackage-server/issues/1128
     , happstack-server      ^>= 7.7.1
     , hashable              ^>= 1.3 || ^>= 1.4
     , hslogger              ^>= 1.3.1