diff --git a/ci/release/_install.sh b/ci/release/_install.sh
index 7141fd22f..d00a9c330 100755
--- a/ci/release/_install.sh
+++ b/ci/release/_install.sh
@@ -148,9 +148,13 @@ main() {
   fi
 
   REPO=${REPO:-terrastruct/d2}
-  PREFIX=${PREFIX:-/usr/local}
   OS=$(os)
   ARCH=$(arch)
+  if [ -z "${PREFIX-}" -a "$OS" = macos -a "$ARCH" = arm64 ]; then
+    # M1 Mac's do not allow modifications to /usr/local even with sudo.
+    PREFIX=$HOME/.local
+  fi
+  PREFIX=${PREFIX:-/usr/local}
   CACHE_DIR=$(cache_dir)
   mkdir -p "$CACHE_DIR"
   INSTALL_DIR=$PREFIX/lib/d2
@@ -212,8 +216,8 @@ install_standalone_d2() {
   log "installing standalone release $ARCHIVE from github"
 
   fetch_release_info
-  asset_line=$(cat "$RELEASE_INFO" | grep -n "$ARCHIVE" | cut -d: -f1 | head -n1)
-  asset_url=$(sed -n $((asset_line-3))p "$RELEASE_INFO" | sed 's/^.*: "\(.*\)",$/\1/g')
+  asset_line=$(sh_c 'cat "$RELEASE_INFO" | grep -n "$ARCHIVE" | cut -d: -f1 | head -n1')
+  asset_url=$(sh_c 'sed -n $((asset_line-3))p "$RELEASE_INFO" | sed "s/^.*: \"\(.*\)\",$/\1/g"')
   fetch_gh "$asset_url" "$CACHE_DIR/$ARCHIVE" 'application/octet-stream'
 
   sh_c="sh_c"
@@ -238,8 +242,8 @@ install_standalone_tala() {
   ARCHIVE="tala-$VERSION-$OS-$ARCH.tar.gz"
   log "installing standalone release $ARCHIVE from github"
 
-  asset_line=$(cat "$RELEASE_INFO" | grep -n "$ARCHIVE" | cut -d: -f1 | head -n1)
-  asset_url=$(sed -n $((asset_line-3))p "$RELEASE_INFO" | sed 's/^.*: "\(.*\)",$/\1/g')
+  asset_line=$(sh_c 'cat "$RELEASE_INFO" | grep -n "$ARCHIVE" | cut -d: -f1 | head -n1')
+  asset_url=$(sh_c 'sed -n $((asset_line-3))p "$RELEASE_INFO" | sed "s/^.*: \"\(.*\)\",$/\1/g"')
 
   fetch_gh "$asset_url" "$CACHE_DIR/$ARCHIVE" 'application/octet-stream'
 
diff --git a/ci/sub b/ci/sub
index b3513e080..9efc8337b 160000
--- a/ci/sub
+++ b/ci/sub
@@ -1 +1 @@
-Subproject commit b3513e080db023620d5ce9532f0fb55293b13a3c
+Subproject commit 9efc8337b86eaebf0fbc9b4c2202f1bdcf156a7d
diff --git a/install.sh b/install.sh
index af7f54d3a..e32450f48 100755
--- a/install.sh
+++ b/install.sh
@@ -33,6 +33,11 @@ rand() {
 }
 
 pick() {
+  if ! command -v shuf >/dev/null || ! command -v md5sum >/dev/null; then
+    eval "_echo \"\$3\""
+    return
+  fi
+
   seed="$1"
   shift
   i="$(rand "$seed" "1-$#")"
@@ -185,12 +190,13 @@ header() {
   logp "/* $1 */"
 }
 
-# humanpath replaces all occurrences of $HOME with ~
+# humanpath replaces all occurrences of " $HOME" with " ~"
+# and all occurrences of '"$HOME' with the literal '"$HOME'.
 humanpath() {
   if [ -z "${HOME-}" ]; then
     cat
   else
-    sed "s#$HOME#~#g"
+    sed -e "s# $HOME# ~#g" -e "s#\"$HOME#\"\$HOME#g"
   fi
 }
 
@@ -562,9 +568,13 @@ main() {
   fi
 
   REPO=${REPO:-terrastruct/d2}
-  PREFIX=${PREFIX:-/usr/local}
   OS=$(os)
   ARCH=$(arch)
+  if [ -z "${PREFIX-}" -a "$OS" = macos -a "$ARCH" = arm64 ]; then
+    # M1 Mac's do not allow modifications to /usr/local even with sudo.
+    PREFIX=$HOME/.local
+  fi
+  PREFIX=${PREFIX:-/usr/local}
   CACHE_DIR=$(cache_dir)
   mkdir -p "$CACHE_DIR"
   INSTALL_DIR=$PREFIX/lib/d2
@@ -626,8 +636,8 @@ install_standalone_d2() {
   log "installing standalone release $ARCHIVE from github"
 
   fetch_release_info
-  asset_line=$(cat "$RELEASE_INFO" | grep -n "$ARCHIVE" | cut -d: -f1 | head -n1)
-  asset_url=$(sed -n $((asset_line-3))p "$RELEASE_INFO" | sed 's/^.*: "\(.*\)",$/\1/g')
+  asset_line=$(sh_c 'cat "$RELEASE_INFO" | grep -n "$ARCHIVE" | cut -d: -f1 | head -n1')
+  asset_url=$(sh_c 'sed -n $((asset_line-3))p "$RELEASE_INFO" | sed "s/^.*: \"\(.*\)\",$/\1/g"')
   fetch_gh "$asset_url" "$CACHE_DIR/$ARCHIVE" 'application/octet-stream'
 
   sh_c="sh_c"
@@ -652,8 +662,8 @@ install_standalone_tala() {
   ARCHIVE="tala-$VERSION-$OS-$ARCH.tar.gz"
   log "installing standalone release $ARCHIVE from github"
 
-  asset_line=$(cat "$RELEASE_INFO" | grep -n "$ARCHIVE" | cut -d: -f1 | head -n1)
-  asset_url=$(sed -n $((asset_line-3))p "$RELEASE_INFO" | sed 's/^.*: "\(.*\)",$/\1/g')
+  asset_line=$(sh_c 'cat "$RELEASE_INFO" | grep -n "$ARCHIVE" | cut -d: -f1 | head -n1')
+  asset_url=$(sh_c 'sed -n $((asset_line-3))p "$RELEASE_INFO" | sed "s/^.*: \"\(.*\)\",$/\1/g"')
 
   fetch_gh "$asset_url" "$CACHE_DIR/$ARCHIVE" 'application/octet-stream'