diff --git a/ci/release/builders/aws_copy_keys.sh b/ci/release/builders/aws_copy_keys.sh
new file mode 100755
index 000000000..df5c46408
--- /dev/null
+++ b/ci/release/builders/aws_copy_keys.sh
@@ -0,0 +1,61 @@
+#!/bin/sh
+set -eu
+cd -- "$(dirname "$0")/../../.."
+. ./ci/sub/lib.sh
+
+help() {
+  cat <<EOF
+usage: $0 [--dry-run] -i keys.pub
+
+$0 copies keys.pub to each builder and then deduplicates its .authorized_keys.
+EOF
+}
+
+main() {
+  while :; do
+    flag_parse "$@"
+    case "$FLAG" in
+      h|help)
+        help
+        return 0
+        ;;
+      dry-run)
+        flag_noarg && shift "$FLAGSHIFT"
+        DRY_RUN=1
+        ;;
+      i)
+        flag_nonemptyarg && shift "$FLAGSHIFT"
+        KEY_FILE=$FLAGARG
+        ;;
+      '')
+        shift "$FLAGSHIFT"
+        break
+        ;;
+      *)
+        flag_errusage "unrecognized flag $FLAGRAW"
+        ;;
+    esac
+  done
+  if [ -z "${KEY_FILE-}" ]; then
+    echoerr "-i is required"
+    exit 1
+  fi
+
+  header linux-amd64
+  REMOTE_HOST=$TSTRUCT_LINUX_AMD64_BUILDER copy_keys
+  header linux-arm64
+  REMOTE_HOST=$TSTRUCT_LINUX_ARM64_BUILDER copy_keys
+  header macos-amd64
+  REMOTE_HOST=$TSTRUCT_MACOS_AMD64_BUILDER copy_keys
+  header macos-arm64
+  REMOTE_HOST=$TSTRUCT_MACOS_ARM64_BUILDER copy_keys
+}
+
+copy_keys() {
+  sh_c ssh-copy-id -fi "$KEY_FILE" "$REMOTE_HOST"
+  sh_c ssh "$REMOTE_HOST" 'cat .ssh/authorized_keys \| sort -u \> .ssh/authorized_keys.dedup'
+  sh_c ssh "$REMOTE_HOST" 'cp .ssh/authorized_keys.dedup .ssh/authorized_keys'
+  sh_c ssh "$REMOTE_HOST" 'rm .ssh/authorized_keys.dedup'
+}
+
+main "$@"
diff --git a/ci/release/builders/aws_ensure.sh b/ci/release/builders/aws_ensure.sh
index dfeb3443c..c82d68fdb 100755
--- a/ci/release/builders/aws_ensure.sh
+++ b/ci/release/builders/aws_ensure.sh
@@ -41,12 +41,12 @@ main() {
   fi
 
   if [ -z "${SKIP_CREATE-}" ]; then
-    create_rhosts
+    create_remote_hosts
   fi
-  init_rhosts
+  init_remote_hosts
 }
 
-create_rhosts() {
+create_remote_hosts() {
   KEY_NAME=$(aws ec2 describe-key-pairs | jq -r .KeyPairs[0].KeyName)
   VPC_ID=$(aws ec2 describe-vpcs | jq -r .Vpcs[0].VpcId)
 
@@ -194,15 +194,15 @@ create_rhosts() {
   done
 }
 
-init_rhosts() {
+init_remote_hosts() {
   header linux-amd64
-  RHOST=$TSTRUCT_LINUX_AMD64_BUILDER init_rhost_linux
+  REMOTE_HOST=$TSTRUCT_LINUX_AMD64_BUILDER init_remote_linux
   header linux-arm64
-  RHOST=$TSTRUCT_LINUX_ARM64_BUILDER init_rhost_linux
+  REMOTE_HOST=$TSTRUCT_LINUX_ARM64_BUILDER init_remote_linux
   header macos-amd64
-  RHOST=$TSTRUCT_MACOS_AMD64_BUILDER init_rhost_macos
+  REMOTE_HOST=$TSTRUCT_MACOS_AMD64_BUILDER init_remote_macos
   header macos-arm64
-  RHOST=$TSTRUCT_MACOS_ARM64_BUILDER init_rhost_macos
+  REMOTE_HOST=$TSTRUCT_MACOS_ARM64_BUILDER init_remote_macos
 
   COLOR=2 header summary
   log "export TSTRUCT_LINUX_AMD64_BUILDER=$TSTRUCT_LINUX_AMD64_BUILDER"
@@ -211,32 +211,32 @@ init_rhosts() {
   log "export TSTRUCT_MACOS_ARM64_BUILDER=$TSTRUCT_MACOS_ARM64_BUILDER"
 }
 
-init_rhost_linux() {
+init_remote_linux() {
   while true; do
-    if sh_c ssh "$RHOST" :; then
+    if sh_c ssh "$REMOTE_HOST" :; then
       break
     fi
     sleep 5
   done
-  sh_c ssh "$RHOST" 'sudo yum upgrade -y'
-  sh_c ssh "$RHOST" 'sudo yum install -y docker'
-  sh_c ssh "$RHOST" 'sudo systemctl start docker'
-  sh_c ssh "$RHOST" 'sudo systemctl enable docker'
-  sh_c ssh "$RHOST" 'sudo usermod -a -G docker ec2-user'
-  sh_c ssh "$RHOST" 'sudo reboot' || true
+  sh_c ssh "$REMOTE_HOST" 'sudo yum upgrade -y'
+  sh_c ssh "$REMOTE_HOST" 'sudo yum install -y docker'
+  sh_c ssh "$REMOTE_HOST" 'sudo systemctl start docker'
+  sh_c ssh "$REMOTE_HOST" 'sudo systemctl enable docker'
+  sh_c ssh "$REMOTE_HOST" 'sudo usermod -a -G docker ec2-user'
+  sh_c ssh "$REMOTE_HOST" 'sudo reboot' || true
 }
 
-init_rhost_macos() {
+init_remote_macos() {
   while true; do
-    if sh_c ssh "$RHOST" :; then
+    if sh_c ssh "$REMOTE_HOST" :; then
       break
     fi
     sleep 5
   done
-  sh_c ssh "$RHOST" '": | /bin/bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)\""'
-  sh_c ssh "$RHOST" 'PATH="/usr/local/bin:/opt/homebrew/bin:\$PATH" brew update'
-  sh_c ssh "$RHOST" 'PATH="/usr/local/bin:/opt/homebrew/bin:\$PATH" brew upgrade'
-  sh_c ssh "$RHOST" 'PATH="/usr/local/bin:/opt/homebrew/bin:\$PATH" brew install go'
+  sh_c ssh "$REMOTE_HOST" '": | /bin/bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)\""'
+  sh_c ssh "$REMOTE_HOST" 'PATH="/usr/local/bin:/opt/homebrew/bin:\$PATH" brew update'
+  sh_c ssh "$REMOTE_HOST" 'PATH="/usr/local/bin:/opt/homebrew/bin:\$PATH" brew upgrade'
+  sh_c ssh "$REMOTE_HOST" 'PATH="/usr/local/bin:/opt/homebrew/bin:\$PATH" brew install go'
 }
 
 main "$@"
diff --git a/ci/release/builders/aws_ssh_copy_id.sh b/ci/release/builders/aws_ssh_copy_id.sh
deleted file mode 100755
index d50a96d9d..000000000
--- a/ci/release/builders/aws_ssh_copy_id.sh
+++ /dev/null
@@ -1,43 +0,0 @@
-#!/bin/sh
-set -eu
-cd -- "$(dirname "$0")/../../.."
-. ./ci/sub/lib.sh
-
-help() {
-  cat <<EOF
-usage: $0 [--dry-run] [...args]
-
-$0 runs ssh-copy-id on each builder.
-args are passed to ssh-copy-id directly.
-EOF
-}
-
-main() {
-  while :; do
-    flag_parse "$@"
-    case "$FLAG" in
-      h|help)
-        help
-        return 0
-        ;;
-      dry-run)
-        flag_noarg && shift "$FLAGSHIFT"
-        DRY_RUN=1
-        ;;
-      '')
-        shift "$FLAGSHIFT"
-        break
-        ;;
-      *)
-        flag_errusage "unrecognized flag $FLAGRAW"
-        ;;
-    esac
-  done
-
-  sh_c ssh-copy-id "$@" "\$TSTRUCT_LINUX_AMD64_BUILDER"
-  sh_c ssh-copy-id "$@" "\$TSTRUCT_LINUX_ARM64_BUILDER"
-  sh_c ssh-copy-id "$@" "\$TSTRUCT_MACOS_AMD64_BUILDER"
-  sh_c ssh-copy-id "$@" "\$TSTRUCT_MACOS_ARM64_BUILDER"
-}
-
-main "$@"