diff --git a/ci/release/build.sh b/ci/release/build.sh
index fed37c716..be40bd835 100755
--- a/ci/release/build.sh
+++ b/ci/release/build.sh
@@ -170,6 +170,7 @@ OS=$OS \
 ARCH=$ARCH \
 ARCHIVE=$ARCHIVE \
 TERM=$TERM \
+PATH=\"/usr/local/bin:/usr/local/sbin\${PATH+:\$PATH}\" \
 ./src/d2/ci/release/_build.sh"
   sh_c rsync --archive --human-readable "$RHOST:src/d2/$ARCHIVE" "$ARCHIVE"
 }
diff --git a/ci/release/builders/ensure_aws.sh b/ci/release/builders/aws_ensure.sh
similarity index 69%
rename from ci/release/builders/ensure_aws.sh
rename to ci/release/builders/aws_ensure.sh
index 3fa4da5c3..d1b1a531c 100755
--- a/ci/release/builders/ensure_aws.sh
+++ b/ci/release/builders/aws_ensure.sh
@@ -66,9 +66,10 @@ create_rhosts() {
   fi
 
   header linux-amd64
-  if ! aws ec2 describe-instances \
-    "--query=Reservations[*].Instances[?State.Name!='terminated']" \
-    | grep -q d2-builder-linux-amd64; then
+  state=$(aws ec2 describe-instances --filters \
+    'Name=instance-state-name,Values=pending,running,stopping,stopped' 'Name=tag:Name,Values=d2-builder-linux-amd64' \
+    | jq -r '.Reservations[].Instances[].State.Name')
+  if [ -z "$state" ]; then
     sh_c aws ec2 run-instances \
       --image-id=ami-0d593311db5abb72b \
       --count=1 \
@@ -80,7 +81,7 @@ create_rhosts() {
   fi
   while true; do
     dnsname=$(sh_c aws ec2 describe-instances \
-      --filters 'Name=instance-state-name,Values=pending,running,shutting-down,stopping,stopped' 'Name=tag:Name,Values=d2-builder-linux-amd64' \
+      --filters 'Name=instance-state-name,Values=pending,running,stopping,stopped' 'Name=tag:Name,Values=d2-builder-linux-amd64' \
       | jq -r '.Reservations[].Instances[].PublicDnsName')
     if [ -n "$dnsname" ]; then
       log "TSTRUCT_LINUX_AMD64_BUILDER=ec2-user@$dnsname"
@@ -91,9 +92,10 @@ create_rhosts() {
   done
 
   header linux-arm64
-  if ! aws ec2 describe-instances \
-    "--query=Reservations[*].Instances[?State.Name!='terminated']" \
-    | grep -q d2-builder-linux-arm64; then
+  state=$(aws ec2 describe-instances --filters \
+    'Name=instance-state-name,Values=pending,running,stopping,stopped' 'Name=tag:Name,Values=d2-builder-linux-arm64' \
+    | jq -r '.Reservations[].Instances[].State.Name')
+  if [ -z "$state" ]; then
     sh_c aws ec2 run-instances \
       --image-id=ami-0efabcf945ffd8831 \
       --count=1 \
@@ -105,7 +107,7 @@ create_rhosts() {
   fi
   while true; do
     dnsname=$(sh_c aws ec2 describe-instances \
-      --filters 'Name=instance-state-name,Values=pending,running,shutting-down,stopping,stopped' 'Name=tag:Name,Values=d2-builder-linux-arm64' \
+      --filters 'Name=instance-state-name,Values=pending,running,stopping,stopped' 'Name=tag:Name,Values=d2-builder-linux-arm64' \
       | jq -r '.Reservations[].Instances[].PublicDnsName')
     if [ -n "$dnsname" ]; then
       log "TSTRUCT_LINUX_ARM64_BUILDER=ec2-user@$dnsname"
@@ -115,31 +117,40 @@ create_rhosts() {
     sleep 5
   done
 
-  header "allocate macOS hosts"
-  if ! aws ec2 describe-hosts | grep -q mac1.metal; then
-    aws ec2 allocate-hosts --instance-type mac1.metal --quantity 1 --availability-zone us-west-2a
+  header "macos-amd64-host"
+  MACOS_AMD64_HOST_ID=$(aws ec2 describe-hosts --filter 'Name=state,Values=pending,available' 'Name=tag:Name,Values=d2-builder-macos-amd64' | jq -r '.Hosts[].HostId')
+  if [ -z "$MACOS_AMD64_HOST_ID" ]; then
+    MACOS_AMD64_HOST_ID=$(sh_c aws ec2 allocate-hosts --instance-type mac1.metal --quantity 1 --availability-zone us-west-2a \
+      --tag-specifications '"ResourceType=dedicated-host,Tags=[{Key=Name,Value=d2-builder-macos-amd64}]"' \
+      | jq -r .HostIds[0])
   fi
-  if ! aws ec2 describe-hosts | grep -q mac2.metal; then
-    aws ec2 allocate-hosts --instance-type mac2.metal --quantity 1 --availability-zone us-west-2a
+
+  header "macos-arm64-host"
+  MACOS_ARM64_HOST_ID=$(aws ec2 describe-hosts --filter 'Name=state,Values=pending,available' 'Name=tag:Name,Values=d2-builder-macos-arm64' | jq -r '.Hosts[].HostId')
+  if [ -z "$MACOS_ARM64_HOST_ID" ]; then
+    MACOS_ARM64_HOST_ID=$(sh_c aws ec2 allocate-hosts --instance-type mac2.metal --quantity 1 --availability-zone us-west-2a \
+      --tag-specifications '"ResourceType=dedicated-host,Tags=[{Key=Name,Value=d2-builder-macos-amd64}]"' \
+      | jq -r .HostIds[0])
   fi
 
   header macos-amd64
-  if ! aws ec2 describe-instances \
-    "--query=Reservations[*].Instances[?State.Name!='terminated']" \
-    | grep -q d2-builder-macos-amd64; then
+  state=$(aws ec2 describe-instances --filters \
+    'Name=instance-state-name,Values=pending,running,stopping,stopped' 'Name=tag:Name,Values=d2-builder-macos-amd64' \
+    | jq -r '.Reservations[].Instances[].State.Name')
+  if [ -z "$state" ]; then
     sh_c aws ec2 run-instances \
       --image-id=ami-0dd2ded7568750663 \
       --count=1 \
       --instance-type=mac1.metal \
       --security-groups=ssh \
       "--key-name=$KEY_NAME" \
-      --placement 'Tenancy=host,HostId=h-0d881926de2e17555' \
+      --placement "Tenancy=host,HostId=$MACOS_AMD64_HOST_ID" \
       --tag-specifications '"ResourceType=instance,Tags=[{Key=Name,Value=d2-builder-macos-amd64}]"' \
         '"ResourceType=volume,Tags=[{Key=Name,Value=d2-builder-macos-amd64}]"' >/dev/null
   fi
   while true; do
     dnsname=$(sh_c aws ec2 describe-instances \
-      --filters 'Name=instance-state-name,Values=pending,running,shutting-down,stopping,stopped' 'Name=tag:Name,Values=d2-builder-macos-amd64' \
+      --filters 'Name=instance-state-name,Values=pending,running,stopping,stopped' 'Name=tag:Name,Values=d2-builder-macos-amd64' \
       | jq -r '.Reservations[].Instances[].PublicDnsName')
     if [ -n "$dnsname" ]; then
       log "TSTRUCT_MACOS_AMD64_BUILDER=ec2-user@$dnsname"
@@ -150,22 +161,23 @@ create_rhosts() {
   done
 
   header macos-arm64
-  if ! aws ec2 describe-instances \
-    "--query=Reservations[*].Instances[?State.Name!='terminated']" \
-    | grep -q d2-builder-macos-arm64; then
+  state=$(aws ec2 describe-instances --filters \
+    'Name=instance-state-name,Values=pending,running,stopping,stopped' 'Name=tag:Name,Values=d2-builder-macos-arm64' \
+    | jq -r '.Reservations[].Instances[].State.Name')
+  if [ -z "$state" ]; then
     sh_c aws ec2 run-instances \
       --image-id=ami-0af0516ff2c43dbbe \
       --count=1 \
       --instance-type=mac2.metal \
       --security-groups=ssh \
       "--key-name=$KEY_NAME" \
-      --placement 'Tenancy=host,HostId=h-040b9305c2d64119d' \
+      --placement "Tenancy=host,HostId=$MACOS_ARM64_HOST_ID" \
       --tag-specifications '"ResourceType=instance,Tags=[{Key=Name,Value=d2-builder-macos-arm64}]"' \
         '"ResourceType=volume,Tags=[{Key=Name,Value=d2-builder-macos-arm64}]"' >/dev/null
   fi
   while true; do
     dnsname=$(sh_c aws ec2 describe-instances \
-      --filters 'Name=instance-state-name,Values=pending,running,shutting-down,stopping,stopped' 'Name=tag:Name,Values=d2-builder-macos-arm64' \
+      --filters 'Name=instance-state-name,Values=pending,running,stopping,stopped' 'Name=tag:Name,Values=d2-builder-macos-arm64' \
       | jq -r '.Reservations[].Instances[].PublicDnsName')
     if [ -n "$dnsname" ]; then
       log "TSTRUCT_MACOS_ARM64_BUILDER=ec2-user@$dnsname"
@@ -216,9 +228,9 @@ init_rhost_macos() {
     sleep 5
   done
   sh_c ssh "$RHOST" '": | /bin/bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)\""'
-  sh_c ssh "$RHOST" 'brew update'
-  sh_c ssh "$RHOST" 'brew upgrade'
-  sh_c ssh "$RHOST" 'brew install go'
+  sh_c ssh "$RHOST" '/usr/local/bin/brew update'
+  sh_c ssh "$RHOST" '/usr/local/bin/brew upgrade'
+  sh_c ssh "$RHOST" '/usr/local/bin/brew install go'
 }
 
 main "$@"
diff --git a/ci/release/builders/aws_ssh_copy_id.sh b/ci/release/builders/aws_ssh_copy_id.sh
new file mode 100755
index 000000000..d50a96d9d
--- /dev/null
+++ b/ci/release/builders/aws_ssh_copy_id.sh
@@ -0,0 +1,43 @@
+#!/bin/sh
+set -eu
+cd -- "$(dirname "$0")/../../.."
+. ./ci/sub/lib.sh
+
+help() {
+  cat <<EOF
+usage: $0 [--dry-run] [...args]
+
+$0 runs ssh-copy-id on each builder.
+args are passed to ssh-copy-id directly.
+EOF
+}
+
+main() {
+  while :; do
+    flag_parse "$@"
+    case "$FLAG" in
+      h|help)
+        help
+        return 0
+        ;;
+      dry-run)
+        flag_noarg && shift "$FLAGSHIFT"
+        DRY_RUN=1
+        ;;
+      '')
+        shift "$FLAGSHIFT"
+        break
+        ;;
+      *)
+        flag_errusage "unrecognized flag $FLAGRAW"
+        ;;
+    esac
+  done
+
+  sh_c ssh-copy-id "$@" "\$TSTRUCT_LINUX_AMD64_BUILDER"
+  sh_c ssh-copy-id "$@" "\$TSTRUCT_LINUX_ARM64_BUILDER"
+  sh_c ssh-copy-id "$@" "\$TSTRUCT_MACOS_AMD64_BUILDER"
+  sh_c ssh-copy-id "$@" "\$TSTRUCT_MACOS_ARM64_BUILDER"
+}
+
+main "$@"
diff --git a/ci/release/template/man/d2.1 b/ci/release/template/man/d2.1
new file mode 100644
index 000000000..6d187ea83
--- /dev/null
+++ b/ci/release/template/man/d2.1
@@ -0,0 +1,62 @@
+.Dd $Mdocdate$
+.Dt d2 1
+.Os
+.Sh NAME
+.Nm d2
+.Nd compiles and renders d2 diagrams into svgs.
+.Sh SYNOPSIS
+.Nm d2
+.Op Fl -watch Ar false
+.Op Fl -theme Em 0
+.Ar file.d2
+.Op Ar file.svg
+.Nm d2
+.Op Fl -watch Ar false
+.Op Fl -theme Em 0
+.Ar file.d2
+.Op Ar ...
+.Nm d2
+.Ar layout Op Ar name
+.Sh DESCRIPTION
+.Nm
+compiles and renders
+.Ar file.d2
+to
+.Ar file.svg
+.Ns .
+.Pp
+Pass - to have
+.Nm
+read from stdin or write to stdout.
+.Pp
+See more docs, the source code and license at
+.Lk https://oss.terrastruct.com/d2
+.Sh OPTIONS
+.Bl -tag -width Fl
+.It Fl w , -watch Ar false
+Watch for changes to input and live reload. Use
+.Ev $PORT and Ev $HOST to specify the listening address.
+.Ev $D2_PORT and $D2_HOST are also accepted and take priority. Default is localhost:0
+.It Fl t , -theme Ar 0
+Set the diagram theme to the passed integer. For a list of available options, see
+.Lk https://oss.terrastruct.com/d2
+.It Fl b , -bundle Ar true
+Bundle all assets and layers into the output svg.
+.It Fl d , -debug
+Print debug logs.
+.It Fl h , -help
+Print usage information and exit.
+.It Fl v , -version
+Print version information and exit.
+.El
+.Sh SUBCOMMANDS
+.Bl -tag -width Fl
+.It Ar layout
+Lists available layout engine options with short help.
+.It Ar layout Op Ar name
+Display long help for a particular layout engine.
+.El
+.Sh SEE ALSO
+.Xr d2plugin-tala 1
+.Sh AUTHORS
+Terrastruct Inc.
diff --git a/ci/release/template/scripts/install.sh b/ci/release/template/scripts/install.sh
index eff495049..454cbca98 100755
--- a/ci/release/template/scripts/install.sh
+++ b/ci/release/template/scripts/install.sh
@@ -11,6 +11,7 @@ main() {
 
   sh_c mkdir -p "$PREFIX"
   sh_c install ./bin/d2 "$PREFIX/bin/d2"
+  sh_c install ./man/d2.1 "$PREFIX/share/man/man1"
 }
 
 main "$@"
diff --git a/ci/release/template/scripts/uninstall.sh b/ci/release/template/scripts/uninstall.sh
index d6d891dca..a41b449c9 100755
--- a/ci/release/template/scripts/uninstall.sh
+++ b/ci/release/template/scripts/uninstall.sh
@@ -10,6 +10,7 @@ main() {
   fi
 
   sh_c rm -f "$PREFIX/bin/d2"
+  sh_c rm -f "$PREFIX/share/man/man1"
 }
 
 main "$@"
diff --git a/install.sh b/install.sh
index 7ca5d42f1..f564dd04e 100755
--- a/install.sh
+++ b/install.sh
@@ -413,6 +413,10 @@ arch() {
     *) echo "$uname_m" ;;
   esac
 }
+
+gh_repo() {
+  gh repo view --json nameWithOwner --template '{{ .nameWithOwner }}'
+}
 #!/bin/sh
 set -eu
 
@@ -754,7 +758,7 @@ fetch_release_info() {
     return 0
   fi
 
-  log "fetching info on version $VERSION"
+  log "fetching info on $VERSION version of $REPO"
   RELEASE_INFO=$(mktemp -d)/release-info.json
   if [ "$VERSION" = latest ]; then
     release_info_url="https://api.github.com/repos/$REPO/releases/$VERSION"