diff --git a/flake.nix b/flake.nix
index 0494413197..3d07a257fa 100644
--- a/flake.nix
+++ b/flake.nix
@@ -148,15 +148,36 @@
           vendorHash = "sha256-OuQWmZmofdJKq1hvk43RPkILQwAuFzqhmB22Xf6Z3lA=";
         };
 
-        # Keep Terraform aligned with provisioner/terraform/testdata/version.txt
-        # so `make gen` remains deterministic in Nix shells.
+        # Pin to provisioner/terraform/testdata/version.txt for deterministic
+        # `make gen` across platforms.
         terraform_1_15_5 =
-          if pkgs.stdenv.isLinux && pkgs.stdenv.hostPlatform.isx86_64 then
+          let
+            releases = {
+              x86_64-linux = {
+                platform = "linux_amd64";
+                hash = "sha256-cCshNq9nKMj/A3+EPdLbzit62IeGtzgdHXKu+iUPYBw=";
+              };
+              aarch64-linux = {
+                platform = "linux_arm64";
+                hash = "sha256-Bue0jegmFGxtkzG6NbE9oSMy2Dkr4w0d1reJukcT//A=";
+              };
+              aarch64-darwin = {
+                platform = "darwin_arm64";
+                hash = "sha256-ARN2YFEABbkYu6ghVIZvvqxDkxY9gnfCq+hh37WELDw=";
+              };
+              x86_64-darwin = {
+                platform = "darwin_amd64";
+                hash = "sha256-NofQfANLPn3u1bByzYris0g1vLE5uuw/xPX9U02r9e0=";
+              };
+            };
+            target = releases.${system} or null;
+          in
+          if target != null then
             pkgs.runCommand "terraform-1.15.5" {
               nativeBuildInputs = [ pkgs.unzip ];
               src = pkgs.fetchurl {
-                url = "https://releases.hashicorp.com/terraform/1.15.5/terraform_1.15.5_linux_amd64.zip";
-                hash = "sha256-cCshNq9nKMj/A3+EPdLbzit62IeGtzgdHXKu+iUPYBw=";
+                url = "https://releases.hashicorp.com/terraform/1.15.5/terraform_1.15.5_${target.platform}.zip";
+                hash = target.hash;
               };
             } ''
               mkdir -p "$out/bin"
diff --git a/provisioner/terraform/testdata/generate.sh b/provisioner/terraform/testdata/generate.sh
index 6e2e5d8422..459796dccb 100755
--- a/provisioner/terraform/testdata/generate.sh
+++ b/provisioner/terraform/testdata/generate.sh
@@ -140,6 +140,17 @@ if [[ " $* " == *" --check "* ]]; then
 	fi
 fi
 
+# Committed testdata encodes linux/amd64 values from coder_provisioner.
+# Regenerating elsewhere bakes in the host OS/arch.
+if [[ "$(uname)" != "Linux" ]]; then
+	if ((upgrade)); then
+		echo "ERROR: --upgrade is not supported on $(uname); run on Linux or via CI."
+		exit 1
+	fi
+	echo "Note: skipping testdata regeneration on $(uname); regenerate on Linux or via CI."
+	exit 0
+fi
+
 # Filter flags from positional args to get directory names.
 declare -a dirs=()
 for arg in "$@"; do
diff --git a/scripts/release/check_commit_metadata.sh b/scripts/release/check_commit_metadata.sh
index 1368425d00..0304747796 100755
--- a/scripts/release/check_commit_metadata.sh
+++ b/scripts/release/check_commit_metadata.sh
@@ -78,7 +78,6 @@ main() {
 		[enterprise]="Enterprise"
 		[examples]="Examples"
 		[helm]="Helm"
-		[install.sh]="Installer"
 		[provisionersdk]="SDK"
 		[provisionerd]="Provisioner"
 		[provisioner]="Provisioner"
@@ -88,6 +87,8 @@ main() {
 		[support]="Support"
 		[tailnet]="Networking"
 	)
+	# shfmt (>=3.13) parses [install.sh] as floating-point arithmetic in array literals.
+	humanized_areas["install.sh"]="Installer"
 
 	# Get hashes for all cherry-picked commits between the selected ref
 	# and main. These are sorted by commit title so that we can group