diff --git a/ci/release/build.sh b/ci/release/build.sh
index 8da755f81..13bb69d42 100755
--- a/ci/release/build.sh
+++ b/ci/release/build.sh
@@ -3,9 +3,26 @@ set -eu
 cd -- "$(dirname "$0")/../.."
 . ./ci/sub/lib.sh
 
+help() {
+  cat <<EOF
+usage: $0 [--rebuild] [--local]
+
+$0 builds D2 release archives into ./ci/release/build/<ref>/d2-<ref>.tar.gz
+
+Flags:
+
+--rebuild: By default build.sh will avoid rebuilding finished assets if they
+           already exist but if you changed something and need to force rebuild, use
+           this flag.
+--local:   By default build.sh uses \$TSTRUCT_MACOS_BUILDER and \$TSTRUCT_LINUX_BUILDER
+           to build the release archives. It's required for now due to the following
+           issue: https://github.com/terrastruct/d2/issues/31
+           With --local, build.sh will cross compile locally.
+           warning: This is only for testing purposes, do not use in production!
+EOF
+}
+
 build() {
-  OS="$1"
-  ARCH="$2"
   BUILD_DIR="$BUILD_DIR/$OS/$ARCH"
 
   mkdir -p "$BUILD_DIR/bin"
@@ -19,14 +36,25 @@ build() {
 }
 
 main() {
+  unset FLAG \
+    FLAGRAW \
+    FLAGARG \
+    FLAGSHIFT \
+    VERSION \
+    REBUILD \
+    DEST  \
+    LOCAL \
   VERSION="$(git_describe_ref)"
   BUILD_DIR="ci/release/build/$VERSION"
-  
 
-  runjob linux-amd64 'OS=linux ARCH=amd64 build linux amd64' &
-  runjob linux-arm64 'OS=linux ARCH=arm64 build linux arm64' &
-  runjob macos-amd64 'OS=macos ARCH=amd64 build macos amd64' &
-  runjob macos-arm64 'OS=macos ARCH=arm64 build macos arm64' &
+  if [ $# -gt 0 ]; then
+    flag_errusage "no arguments are accepted"
+  fi
+
+  runjob linux-amd64 'OS=linux ARCH=amd64 build' &
+  runjob linux-arm64 'OS=linux ARCH=arm64 build' &
+  runjob macos-amd64 'OS=macos ARCH=amd64 build' &
+  runjob macos-arm64 'OS=macos ARCH=arm64 build' &
   wait_jobs
 }
 
diff --git a/ci/release/release.sh b/ci/release/release.sh
index 6e9a82835..149e53570 100755
--- a/ci/release/release.sh
+++ b/ci/release/release.sh
@@ -14,12 +14,13 @@ Flags:
 --rebuild: Normally the release script will avoid rebuilding release assets if they
            already exist but if you changed something and need to force rebuild, use
            this flag.
---pre-release: Pass to mark the release on GitHub as a pre-release. For pre-releases the
+--prerelease: Pass to mark the release on GitHub as a pre-release. For pre-releases the
                version format should include a suffix like v0.0.99-alpha.1
                As well, for pre-releases the script will not overwrite changelogs/next.md
                with changelogs/template.md and instead keep it the same as
                changelogs/v0.0.99-alpha.1.md. This is because you want to maintain the
                changelog entries for the eventual final release.
+--dryrun: Print the commands that would be ran without executing them.
 
 Process:
 
@@ -68,7 +69,8 @@ main() {
     FLAGSHIFT \
     VERSION \
     REBUILD \
-    PRERELEASE
+    PRERELEASE \
+    DRYRUN
   while :; do
     flag_parse "$@"
     case "$FLAG" in
@@ -81,11 +83,16 @@ main() {
         REBUILD=1
         shift "$FLAGSHIFT"
         ;;
-      pre-release)
+      prerelease)
         flag_noarg
         PRERELEASE=1
         shift "$FLAGSHIFT"
         ;;
+      dryrun)
+        flag_noarg
+        DRYRUN=1
+        shift "$FLAGSHIFT"
+        ;;
       '')
         shift "$FLAGSHIFT"
         break
@@ -113,7 +120,7 @@ main() {
   header '9_upload_assets' && _9_upload_assets
 
   COLOR=2 header 'final steps'
-  cat <<EOF
+  cat >&2 <<EOF
 1. Review and test the release: $release_url
 2. Merge the PR: $pr_url
 3. Publish the release!
@@ -162,13 +169,14 @@ _5_ensure_tag() {
 }
 
 _6_ensure_release() {
-  if gh release view "$VERSION" >/dev/null 2>&1; then
-    release_url="$(sh_c gh release edit \
+  release_url="$(gh release view "$VERSION" --json=url '--template={{ .url }}' 2>/dev/null || true)"
+  if [ -n "$release_url" ]; then
+    sh_c gh release edit \
       --draft \
       --notes-file "./ci/release/changelogs/$VERSION.md" \
       ${PRERELEASE:+--prerelease} \
       "--title=$VERSION" \
-      "$VERSION" | tee /dev/stderr)"
+      "$VERSION" | tee /dev/stderr
     return 0
   fi
   release_url="$(sh_c gh release create \
@@ -192,8 +200,7 @@ _7_ensure_pr() {
 }
 
 _8_ensure_assets() {
-  # ./ci/release/build.sh ${REBUILD:+--rebuild} $VERSION
-  log TODO
+  sh_c ./ci/release/build.sh ${REBUILD:+--rebuild}
 }
 
 _9_upload_assets() {
diff --git a/ci/sub b/ci/sub
index 3412fc4a9..d95383e2e 160000
--- a/ci/sub
+++ b/ci/sub
@@ -1 +1 @@
-Subproject commit 3412fc4a998dd70e5d0de20a9bfb526023b093cc
+Subproject commit d95383e2ed77d82ffc34b8ecd0a90b5cc7b89d97