diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c729fa7b3..75c7b2e96 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,9 +15,7 @@
 
 name: Release
 permissions:
-  "attestations": "write"
   "contents": "write"
-  "id-token": "write"
 
 # This task will run whenever you push a git tag that looks like a version
 # like "1.0.0", "v0.1.0-prerelease.1", "my-app/0.1.0", "releases/v1.0.0", etc.
@@ -66,7 +64,7 @@ jobs:
         # we specify bash to get pipefail; it guards against the `curl` command
         # failing. otherwise `sh` won't catch that `curl` returned non-0
         shell: bash
-        run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.0/cargo-dist-installer.sh | sh"
+        run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.1-prerelease.2/cargo-dist-installer.sh | sh"
       - name: Cache dist
         uses: actions/upload-artifact@v4
         with:
@@ -114,6 +112,10 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       BUILD_MANIFEST_NAME: target/distrib/${{ join(matrix.targets, '-') }}-dist-manifest.json
+    permissions:
+      "attestations": "write"
+      "contents": "read"
+      "id-token": "write"
     steps:
       - name: enable windows longpaths
         run: |
@@ -223,8 +225,8 @@ jobs:
       - plan
       - build-local-artifacts
       - build-global-artifacts
-    # Only run if we're "publishing", and only if local and global didn't fail (skipped is fine)
-    if: ${{ always() && needs.plan.outputs.publishing == 'true' && (needs.build-global-artifacts.result == 'skipped' || needs.build-global-artifacts.result == 'success') && (needs.build-local-artifacts.result == 'skipped' || needs.build-local-artifacts.result == 'success') }}
+    # Only run if we're "publishing", and only if plan, local and global didn't fail (skipped is fine)
+    if: ${{ always() && needs.plan.result == 'success' && needs.plan.outputs.publishing == 'true' && (needs.build-global-artifacts.result == 'skipped' || needs.build-global-artifacts.result == 'success') && (needs.build-local-artifacts.result == 'skipped' || needs.build-local-artifacts.result == 'success') }}
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     runs-on: "ubuntu-22.04"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e3460f768..5a3fb0229 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,13 @@
 # Unreleased
 
-In order to avoid overly broad permissions, GitHub attestations permissions scope is moved to the job level. 
+Nothing Yet!
+
+
+# Version 0.30.1 (2025-10-29)
+
+* Bump default x64 macos runners to macos-15-intel (macos-13 is deprecated)
+* In order to avoid overly broad permissions, GitHub attestations permissions scope is moved to the job level. 
+* Don't run host job if plan fails
 
 # Version 0.30.0 (2025-09-07)
 
diff --git a/Cargo.lock b/Cargo.lock
index 283758371..9012f99b6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -186,7 +186,7 @@ dependencies = [
 
 [[package]]
 name = "axoproject"
-version = "0.30.0"
+version = "0.30.1"
 dependencies = [
  "axoasset",
  "axoprocess",
@@ -352,7 +352,7 @@ dependencies = [
 
 [[package]]
 name = "cargo-dist"
-version = "0.30.0"
+version = "0.30.1"
 dependencies = [
  "axoasset",
  "axocli",
@@ -402,7 +402,7 @@ dependencies = [
 
 [[package]]
 name = "cargo-dist-schema"
-version = "0.30.0"
+version = "0.30.1"
 dependencies = [
  "camino",
  "insta",
diff --git a/Cargo.toml b/Cargo.toml
index 8244afb5b..60db2cdc0 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -12,13 +12,13 @@ edition = "2021"
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/axodotdev/cargo-dist"
 homepage = "https://axodotdev.github.io/cargo-dist"
-version = "0.30.0"
+version = "0.30.1"
 rust-version = "1.74"
 
 [workspace.dependencies]
 # intra-workspace deps (you need to bump these versions when you cut releases too!
-cargo-dist-schema = { version = "=0.30.0", path = "cargo-dist-schema" }
-axoproject = { version = "=0.30.0", path = "axoproject", default-features = false, features = ["cargo-projects", "generic-projects", "npm-projects"] }
+cargo-dist-schema = { version = "=0.30.1", path = "cargo-dist-schema" }
+axoproject = { version = "=0.30.1", path = "axoproject", default-features = false, features = ["cargo-projects", "generic-projects", "npm-projects"] }
 
 # first-party deps
 axocli = { version = "0.3.0" }
diff --git a/dist-workspace.toml b/dist-workspace.toml
index b66f7cfcf..4696c6b7b 100644
--- a/dist-workspace.toml
+++ b/dist-workspace.toml
@@ -4,7 +4,7 @@ members = ["cargo:."]
 # Config for 'dist'
 [dist]
 # The preferred dist version to use in CI (Cargo.toml SemVer syntax)
-cargo-dist-version = "0.30.0"
+cargo-dist-version = "0.30.1-prerelease.2"
 # CI backends to support
 ci = "github"
 # The installers to generate for each app