diff --git a/ci/release/template/scripts/lib.sh b/ci/release/template/scripts/lib.sh
index fa7ad8bda..bb420b0e7 100644
--- a/ci/release/template/scripts/lib.sh
+++ b/ci/release/template/scripts/lib.sh
@@ -287,6 +287,16 @@ hide() {
   return "$code"
 }
 
+hide_stderr() {
+  out="$(mktempd)/hideout"
+  capcode "$@" 2>"$out"
+  if [ "$code" -eq 0 ]; then
+    return
+  fi
+  cat "$out" >&2
+  return "$code"
+}
+
 echo_dur() {
   local dur=$1
   local h=$((dur/60/60))
diff --git a/ci/sub b/ci/sub
index e6aadd1bd..7d2454610 160000
--- a/ci/sub
+++ b/ci/sub
@@ -1 +1 @@
-Subproject commit e6aadd1bd0862f5727d6ad57d9987074d4bc7aba
+Subproject commit 7d24546108e23fe4509e53f7eee7cb76fbf3ed7f
diff --git a/go.mod b/go.mod
index ed8638a4f..61c5cdf4f 100644
--- a/go.mod
+++ b/go.mod
@@ -21,7 +21,7 @@ require (
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2
 	gonum.org/v1/plot v0.12.0
 	nhooyr.io/websocket v1.8.7
-	oss.terrastruct.com/util-go v0.0.0-20221213064803-b54fe6f51e24
+	oss.terrastruct.com/util-go v0.0.0-20221213065535-54a44e3bb564
 )
 
 require (
diff --git a/go.sum b/go.sum
index 8ca3f644a..6d7185401 100644
--- a/go.sum
+++ b/go.sum
@@ -806,8 +806,8 @@ honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 nhooyr.io/websocket v1.8.7 h1:usjR2uOr/zjjkVMy0lW+PPohFok7PCow5sDjLgX4P4g=
 nhooyr.io/websocket v1.8.7/go.mod h1:B70DZP8IakI65RVQ51MsWP/8jndNma26DVA/nFSCgW0=
-oss.terrastruct.com/util-go v0.0.0-20221213064803-b54fe6f51e24 h1:+xfAiRxAWPN4Ls3XBlwfevc24NrjtuJUKYUaVHsJQ20=
-oss.terrastruct.com/util-go v0.0.0-20221213064803-b54fe6f51e24/go.mod h1:Fwy72FDIOOM4K8F96ScXkxHHppR1CPfUyo9+x9c1PBU=
+oss.terrastruct.com/util-go v0.0.0-20221213065535-54a44e3bb564 h1:EclkOBDnZpKJMFATicEYq7UOJL1Yik+1kaLlavB1mHc=
+oss.terrastruct.com/util-go v0.0.0-20221213065535-54a44e3bb564/go.mod h1:Fwy72FDIOOM4K8F96ScXkxHHppR1CPfUyo9+x9c1PBU=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/pdf v0.1.1 h1:k1MczvYDUvJBe93bYd7wrZLLUEcLZAuF824/I4e5Xr4=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
diff --git a/install.sh b/install.sh
index 0e0987fcf..40a271f0e 100755
--- a/install.sh
+++ b/install.sh
@@ -292,6 +292,16 @@ hide() {
   return "$code"
 }
 
+hide_stderr() {
+  out="$(mktempd)/hideout"
+  capcode "$@" 2>"$out"
+  if [ "$code" -eq 0 ]; then
+    return
+  fi
+  cat "$out" >&2
+  return "$code"
+}
+
 echo_dur() {
   local dur=$1
   local h=$((dur/60/60))