diff --git a/ci/release/build.sh b/ci/release/build.sh
index e8148a83e..a9636624f 100755
--- a/ci/release/build.sh
+++ b/ci/release/build.sh
@@ -58,6 +58,9 @@ Flags:
   images into the daemon for push later. It's not slow though to use --push-docker after
   building the image as nearly all artifacts are cached.
   Automatically set if called from release.sh
+
+--latest-docker
+  Mark the built image with the latest tag. Automatically set if called from release.sh
 EOF
 }
 
@@ -113,6 +116,10 @@ main() {
         flag_noarg && shift "$FLAGSHIFT"
         PUSH_DOCKER=1
         ;;
+      latest-docker)
+        flag_noarg && shift "$FLAGSHIFT"
+        LATEST_DOCKER=1
+        ;;
       *)
         flag_errusage "unrecognized flag $FLAGRAW"
         ;;
@@ -149,7 +156,7 @@ main() {
   runjob windows/arm64 'OS=windows ARCH=arm64 build' &
   waitjobs
 
-  runjob linux/dockerimage 'OS=linux build_docker_image' &
+  runjob linux/docker build_docker &
   runjob windows/amd64/msi 'OS=windows ARCH=amd64 build_windows_msi' &
   waitjobs
 }
@@ -247,14 +254,12 @@ ARCHIVE=$ARCHIVE \
   sh_c rsync --archive --human-readable "$REMOTE_HOST:src/d2/$ARCHIVE" "$ARCHIVE"
 )}
 
-build_docker_image() {
-  D2_DOCKER_IMAGE=${D2_DOCKER_IMAGE:-terrastruct/d2}
-  flags='--load'
-  if [ -n "${PUSH_DOCKER-}" -o -n "${RELEASE-}" ]; then
-    flags='--push --platform linux/amd64,linux/arm64'
-  fi
-  sh_c rsync --archive --human-readable ./ci/release/Dockerfile_entrypoint.sh "./ci/release/build/$VERSION"
-  sh_c docker buildx build $flags -t "$D2_DOCKER_IMAGE:$VERSION" -t "$D2_DOCKER_IMAGE:latest" --build-arg "VERSION=$VERSION" -f ./ci/release/Dockerfile "./ci/release/build/$VERSION"
+build_docker() {
+  sh_c lockfile_ssh "$CI_D2_LINUX_AMD64" .d2-build-lock
+  sh_c gitsync "$CI_D2_LINUX_AMD64" src/d2
+  sh_c ssh "$CI_D2_LINUX_AMD64" ./src/d2/ci/release/docker/build.sh \
+    ${PUSH_DOCKER:+--push} \
+    ${LATEST_DOCKER:+--latest}
 }
 
 build_windows_msi() {
diff --git a/ci/release/Dockerfile b/ci/release/docker/Dockerfile
similarity index 95%
rename from ci/release/Dockerfile
rename to ci/release/docker/Dockerfile
index 3d7f843bc..50f51c21a 100644
--- a/ci/release/Dockerfile
+++ b/ci/release/docker/Dockerfile
@@ -21,7 +21,7 @@ RUN curl -fsSL "https://github.com/boxboat/fixuid/releases/download/v0.5/fixuid-
   && printf "user: debian\ngroup: debian\npaths: [/home/debian]\n" > /etc/fixuid/config.yml
 
 COPY ./d2-*-linux-$TARGETARCH.tar.gz /tmp
-ADD ./Dockerfile_entrypoint.sh /usr/local/bin/entrypoint.sh
+ADD ./entrypoint.sh /usr/local/bin/entrypoint.sh
 RUN mkdir -p /usr/local/lib/d2 \
       && tar -C /usr/local/lib/d2 -xzf /tmp/d2-*-linux-"$TARGETARCH".tar.gz \
       && /usr/local/lib/d2/d2-*/scripts/install.sh \
diff --git a/ci/release/docker/build.sh b/ci/release/docker/build.sh
new file mode 100755
index 000000000..0f7475d4f
--- /dev/null
+++ b/ci/release/docker/build.sh
@@ -0,0 +1,57 @@
+#!/bin/sh
+set -eu
+
+. "$(dirname "$0")/../../../ci/sub/lib.sh"
+cd -- "$(dirname "$0")/../../.."
+
+help() {
+      cat <<EOF
+usage: $0 [-p|--push] [--latest] [
+EOF
+}
+
+main() {
+  while flag_parse "$@"; do
+    case "$FLAG" in
+      h|help)
+        help
+        return 0
+        ;;
+      p|push)
+        flag_noarg && shift "$FLAGSHIFT"
+        PUSH=1
+        ;;
+      latest)
+        flag_noarg && shift "$FLAGSHIFT"
+        LATEST=1
+        ;;
+      *)
+        flag_errusage "unrecognized flag $FLAGRAW"
+        ;;
+    esac
+  done
+  shift "$FLAGSHIFT"
+
+  if [ -z "${VERSION-}" ]; then
+    VERSION=$(readlink ./ci/release/build/latest)
+  fi
+  D2_DOCKER_IMAGE=${D2_DOCKER_IMAGE:-terrastruct/d2}
+
+  sh_c mkdir -p "./ci/release/build/$VERSION/docker"
+  sh_c cp "./ci/release/build/$VERSION/d2-$VERSION"-linux-*.tar.gz "./ci/release/build/$VERSION/docker/"
+  sh_c cp ./ci/release/docker/entrypoint.sh "./ci/release/build/$VERSION/docker/entrypoint.sh"
+
+  flags='--load'
+  if [ -n "${PUSH-}" -o -n "${RELEASE-}" ]; then
+    flags='--push --platform linux/amd64,linux/arm64'
+  fi
+  if [ -n "${LATEST-}" -o -n "${RELEASE-}" ]; then
+    flags="$flags -t $D2_DOCKER_IMAGE:latest"
+  fi
+  sh_c docker buildx build $flags \
+    -t "$D2_DOCKER_IMAGE:$VERSION" \
+    --build-arg "VERSION=$VERSION" \
+    -f ./ci/release/docker/Dockerfile "./ci/release/build/$VERSION/docker"
+}
+
+main "$@"
diff --git a/ci/release/Dockerfile_entrypoint.sh b/ci/release/docker/entrypoint.sh
similarity index 100%
rename from ci/release/Dockerfile_entrypoint.sh
rename to ci/release/docker/entrypoint.sh