diff --git a/Makefile b/Makefile
index 3bbb91151f..c0206bc300 100644
--- a/Makefile
+++ b/Makefile
@@ -25,7 +25,7 @@ else
 	endif
 endif
 
-CLI_VERSION := $(if $(shell git describe --tags),$(shell git describe --tags),"UnknownVersion")
+CLI_VERSION ?= $(if $(shell git describe --tags),$(shell git describe --tags),"UnknownVersion")
 GIT_SHA := $(if $(shell git rev-parse HEAD),$(shell git rev-parse HEAD),"")
 BUILD_DATE := $(shell date -u +'%Y-%m-%dT%H:%M:%SZ')
 BUILD_ARGS := -s -w -X 'github.com/defenseunicorns/zarf/src/config.CLIVersion=$(CLI_VERSION)' -X 'k8s.io/component-base/version.gitVersion=v0.0.0+zarf$(CLI_VERSION)' -X 'k8s.io/component-base/version.gitCommit=$(GIT_SHA)' -X 'k8s.io/component-base/version.buildDate=$(BUILD_DATE)'
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf.md b/docs/2-the-zarf-cli/100-cli-commands/zarf.md
index ddff081c4b..01aba71221 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf.md
@@ -15,7 +15,7 @@ zarf [COMMAND] [flags]
 ## Options
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
   -h, --help                  help for zarf
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_completion.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_completion.md
index 6c8a72ffa3..de425f32f1 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_completion.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_completion.md
@@ -18,7 +18,7 @@ See each sub-command's help for details on how to use the generated script.
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_completion_bash.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_completion_bash.md
index 0a9c24bee6..f594d2ffcf 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_completion_bash.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_completion_bash.md
@@ -41,7 +41,7 @@ zarf completion bash
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_completion_fish.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_completion_fish.md
index 5961138e08..91d75d4305 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_completion_fish.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_completion_fish.md
@@ -32,7 +32,7 @@ zarf completion fish [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_completion_powershell.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_completion_powershell.md
index ddd612008b..843df558f3 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_completion_powershell.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_completion_powershell.md
@@ -29,7 +29,7 @@ zarf completion powershell [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_completion_zsh.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_completion_zsh.md
index 791788d317..f3e6502bde 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_completion_zsh.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_completion_zsh.md
@@ -43,7 +43,7 @@ zarf completion zsh [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_connect.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_connect.md
index c255e76e84..b319d46f0a 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_connect.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_connect.md
@@ -32,7 +32,7 @@ zarf connect {REGISTRY|LOGGING|GIT|connect-name} [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_connect_list.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_connect_list.md
index 43c2ca7f12..ced246d53a 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_connect_list.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_connect_list.md
@@ -16,7 +16,7 @@ zarf connect list [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_destroy.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_destroy.md
index d75f053d7b..3cd5f2768b 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_destroy.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_destroy.md
@@ -28,7 +28,7 @@ zarf destroy [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_init.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_init.md
index d81d50f712..a77e6b3267 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_init.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_init.md
@@ -69,7 +69,7 @@ zarf init --git-push-password={PASSWORD} --git-push-username={USERNAME} --git-ur
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_package.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_package.md
index 36952c66b4..205e46b363 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_package.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_package.md
@@ -12,7 +12,7 @@ Zarf package commands for creating, deploying, and inspecting packages
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_package_create.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_package_create.md
index e62180a4be..6e24d20178 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_package_create.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_package_create.md
@@ -33,7 +33,7 @@ zarf package create [DIRECTORY] [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_package_deploy.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_package_deploy.md
index c4e444f273..5763caf25b 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_package_deploy.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_package_deploy.md
@@ -28,7 +28,7 @@ zarf package deploy [PACKAGE] [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_package_inspect.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_package_inspect.md
index 79a3c80d36..6809be554f 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_package_inspect.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_package_inspect.md
@@ -24,7 +24,7 @@ zarf package inspect [PACKAGE] [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_package_list.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_package_list.md
index 72b5a761e1..857f2ad883 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_package_list.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_package_list.md
@@ -16,7 +16,7 @@ zarf package list [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_package_publish.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_package_publish.md
index 6e90cd636f..3d669b0872 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_package_publish.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_package_publish.md
@@ -25,7 +25,7 @@ zarf package publish [PACKAGE] [REPOSITORY] [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_package_pull.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_package_pull.md
index 0b40e4a373..a18165796f 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_package_pull.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_package_pull.md
@@ -24,7 +24,7 @@ zarf package pull [REFERENCE] [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_package_remove.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_package_remove.md
index daa4a64949..4b8242d9e0 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_package_remove.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_package_remove.md
@@ -18,7 +18,7 @@ zarf package remove {PACKAGE_NAME|PACKAGE_FILE} [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_prepare.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_prepare.md
index 28990a4745..fe8a0ea609 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_prepare.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_prepare.md
@@ -12,7 +12,7 @@ Tools to help prepare assets for packaging
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_prepare_find-images.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_prepare_find-images.md
index cc4c24e158..0b81b1dfda 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_prepare_find-images.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_prepare_find-images.md
@@ -25,7 +25,7 @@ zarf prepare find-images [PACKAGE] [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_prepare_generate-config.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_prepare_generate-config.md
index 100a6094ad..9f33435933 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_prepare_generate-config.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_prepare_generate-config.md
@@ -25,7 +25,7 @@ zarf prepare generate-config [FILENAME] [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_prepare_patch-git.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_prepare_patch-git.md
index 4ff7daeb5f..d23a0a8b0a 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_prepare_patch-git.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_prepare_patch-git.md
@@ -18,7 +18,7 @@ zarf prepare patch-git [HOST] [FILE] [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_prepare_sha256sum.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_prepare_sha256sum.md
index 594ae43d28..1dd1097ce3 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_prepare_sha256sum.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_prepare_sha256sum.md
@@ -16,7 +16,7 @@ zarf prepare sha256sum [FILE|URL] [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools.md
index 6da64098da..06cf0b1333 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools.md
@@ -12,7 +12,7 @@ Collection of additional tools to make airgap easier
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
@@ -26,6 +26,7 @@ Collection of additional tools to make airgap easier
 * [zarf](zarf.md)	 - DevSecOps for Airgap
 * [zarf tools archiver](zarf_tools_archiver.md)	 - Compress/Decompress generic archives, including Zarf packages.
 * [zarf tools clear-cache](zarf_tools_clear-cache.md)	 - Clears the configured git and image cache directory.
+* [zarf tools download-init](zarf_tools_download-init.md)	 - Download the init package for the current Zarf version into the specified directory.
 * [zarf tools gen-key](zarf_tools_gen-key.md)	 - Generates a cosign public/private keypair that can be used to sign packages
 * [zarf tools gen-pki](zarf_tools_gen-pki.md)	 - Generates a Certificate Authority and PKI chain of trust for the given host
 * [zarf tools get-creds](zarf_tools_get-creds.md)	 - Display a Table of credentials for deployed components. Pass a component name to get a single credential.
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_archiver.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_archiver.md
index b7f090a319..374810ee58 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_archiver.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_archiver.md
@@ -12,7 +12,7 @@ Compress/Decompress generic archives, including Zarf packages.
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_archiver_compress.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_archiver_compress.md
index e60bbe0b7b..484407e768 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_archiver_compress.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_archiver_compress.md
@@ -16,7 +16,7 @@ zarf tools archiver compress {SOURCES} {ARCHIVE} [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_archiver_decompress.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_archiver_decompress.md
index d9f006cc08..005cde46a8 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_archiver_decompress.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_archiver_decompress.md
@@ -17,7 +17,7 @@ zarf tools archiver decompress {ARCHIVE} {DESTINATION} [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_clear-cache.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_clear-cache.md
index e02cd30297..e73ecec272 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_clear-cache.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_clear-cache.md
@@ -17,7 +17,7 @@ zarf tools clear-cache [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_download-init.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_download-init.md
new file mode 100644
index 0000000000..a4b5730d56
--- /dev/null
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_download-init.md
@@ -0,0 +1,31 @@
+# zarf tools download-init
+<!-- Auto-generated by docs/gen-cli-docs.sh -->
+
+Download the init package for the current Zarf version into the specified directory.
+
+```
+zarf tools download-init [flags]
+```
+
+## Options
+
+```
+  -h, --help                      help for download-init
+  -o, --output-directory string   Specify a directory to place the init package in.
+```
+
+## Options inherited from parent commands
+
+```
+  -a, --architecture string   Architecture for OCI images and Zarf packages
+      --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
+  -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
+      --no-log-file           Disable log file creation
+      --no-progress           Disable fancy UI progress bars, spinners, logos, etc
+      --tmpdir string         Specify the temporary directory to use for intermediate files
+      --zarf-cache string     Specify the location of the Zarf cache directory (default "~/.zarf-cache")
+```
+
+## SEE ALSO
+
+* [zarf tools](zarf_tools.md)	 - Collection of additional tools to make airgap easier
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_gen-key.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_gen-key.md
index a2788f75ba..33127e3163 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_gen-key.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_gen-key.md
@@ -16,7 +16,7 @@ zarf tools gen-key [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_gen-pki.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_gen-pki.md
index 3117cba52c..285a02808d 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_gen-pki.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_gen-pki.md
@@ -17,7 +17,7 @@ zarf tools gen-pki {HOST} [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_get-creds.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_get-creds.md
index 564415a3f3..d7f8c61490 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_get-creds.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_get-creds.md
@@ -20,7 +20,7 @@ zarf tools get-creds [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_kubectl.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_kubectl.md
index ae33ea9c7b..6f4457e2f5 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_kubectl.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_kubectl.md
@@ -16,7 +16,7 @@ zarf tools kubectl [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_monitor.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_monitor.md
index be6566181d..f901a9628a 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_monitor.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_monitor.md
@@ -16,7 +16,7 @@ zarf tools monitor [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry.md
index 976441b52a..e6934d5b15 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry.md
@@ -12,7 +12,7 @@ Tools for working with container registries using go-containertools.
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry_catalog.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry_catalog.md
index 9a5fc69c44..c3da8d09ca 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry_catalog.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry_catalog.md
@@ -26,7 +26,7 @@ zarf tools registry catalog [REGISTRY] [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry_copy.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry_copy.md
index 16a7c0fe4c..c7bf2ee111 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry_copy.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry_copy.md
@@ -16,7 +16,7 @@ zarf tools registry copy SRC DST [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry_login.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry_login.md
index d44ab45f00..d4cb17f9cb 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry_login.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry_login.md
@@ -19,7 +19,7 @@ zarf tools registry login [OPTIONS] [SERVER] [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry_pull.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry_pull.md
index c62106daee..9341061985 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry_pull.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry_pull.md
@@ -19,7 +19,7 @@ zarf tools registry pull IMAGE TARBALL [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry_push.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry_push.md
index 3ba129d2d4..2497e79803 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry_push.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_registry_push.md
@@ -22,7 +22,7 @@ zarf tools registry push PATH IMAGE [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom.md
index b3bfe85004..46e2454d0e 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom.md
@@ -31,7 +31,7 @@ zarf tools sbom [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom_attest.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom_attest.md
index 49d0992d65..31aac373e5 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom_attest.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom_attest.md
@@ -29,7 +29,7 @@ zarf tools sbom attest --output [FORMAT] <IMAGE> [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
   -c, --config string         application config file
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom_convert.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom_convert.md
index 9476cfc2fd..5a8da978e1 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom_convert.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom_convert.md
@@ -28,7 +28,7 @@ zarf tools sbom convert [SOURCE-SBOM] -o [FORMAT] [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
   -c, --config string         application config file
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom_login.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom_login.md
index beed5f43ce..9049450c25 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom_login.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom_login.md
@@ -19,7 +19,7 @@ zarf tools sbom login [OPTIONS] [SERVER] [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
   -c, --config string         application config file
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom_packages.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom_packages.md
index c1d43a1e13..bc55fff5d3 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom_packages.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom_packages.md
@@ -28,7 +28,7 @@ zarf tools sbom packages [SOURCE] [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
   -c, --config string         application config file
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom_version.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom_version.md
index 52cd8bfa55..5d4564dded 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom_version.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_sbom_version.md
@@ -17,7 +17,7 @@ zarf tools sbom version [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
   -c, --config string         application config file
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_wait-for.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_wait-for.md
index 56047af73e..605b15dfc5 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_wait-for.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_tools_wait-for.md
@@ -46,7 +46,7 @@ zarf tools wait-for {KIND|PROTOCOL} {NAME|SELECTOR|URI} {CONDITION|HTTP_CODE} [f
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/docs/2-the-zarf-cli/100-cli-commands/zarf_version.md b/docs/2-the-zarf-cli/100-cli-commands/zarf_version.md
index b5f4a5bc74..f0a46580f1 100644
--- a/docs/2-the-zarf-cli/100-cli-commands/zarf_version.md
+++ b/docs/2-the-zarf-cli/100-cli-commands/zarf_version.md
@@ -20,7 +20,7 @@ zarf version [flags]
 ## Options inherited from parent commands
 
 ```
-  -a, --architecture string   Architecture for OCI images
+  -a, --architecture string   Architecture for OCI images and Zarf packages
       --insecure              Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
   -l, --log-level string      Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info")
       --no-log-file           Disable log file creation
diff --git a/src/cmd/initialize.go b/src/cmd/initialize.go
index 61df5076c0..c85b9ba75f 100644
--- a/src/cmd/initialize.go
+++ b/src/cmd/initialize.go
@@ -81,7 +81,7 @@ func findInitPackage(initPackageName string) (string, error) {
 
 	// Create the cache directory if it doesn't exist
 	if utils.InvalidPath(config.GetAbsCachePath()) {
-		if err := os.MkdirAll(config.GetAbsCachePath(), 0755); err != nil {
+		if err := utils.CreateDirectory(config.GetAbsCachePath(), 0755); err != nil {
 			message.Fatalf(err, lang.CmdInitErrUnableCreateCache, config.GetAbsCachePath())
 		}
 	}
@@ -93,7 +93,7 @@ func findInitPackage(initPackageName string) (string, error) {
 
 	// Finally, if the init-package doesn't exist in the cache directory, suggest downloading it
 	downloadCacheTarget := filepath.Join(config.GetAbsCachePath(), initPackageName)
-	if err := downloadInitPackage(initPackageName, downloadCacheTarget); err != nil {
+	if err := downloadInitPackage(downloadCacheTarget); err != nil {
 		if errors.Is(err, lang.ErrInitNotFound) {
 			message.Fatal(err, err.Error())
 		} else {
@@ -103,13 +103,13 @@ func findInitPackage(initPackageName string) (string, error) {
 	return downloadCacheTarget, nil
 }
 
-func downloadInitPackage(initPackageName, downloadCacheTarget string) error {
+func downloadInitPackage(downloadCacheTarget string) error {
 	if config.CommonOptions.Confirm {
 		return lang.ErrInitNotFound
 	}
 
 	var confirmDownload bool
-	url := fmt.Sprintf("https://github.com/%s/releases/download/%s/%s", config.GithubProject, config.CLIVersion, initPackageName)
+	url := packager.GetInitPackageRemote("")
 
 	// Give the user the choice to download the init-package and note that this does require an internet connection
 	message.Question(fmt.Sprintf(lang.CmdInitDownloadAsk, url))
@@ -122,7 +122,7 @@ func downloadInitPackage(initPackageName, downloadCacheTarget string) error {
 			Message: lang.CmdInitDownloadConfirm,
 		}
 		if err := survey.AskOne(prompt, &confirmDownload); err != nil {
-			return fmt.Errorf(lang.CmdInitDownloadCancel, err.Error())
+			return fmt.Errorf(lang.CmdInitDownloadErrCancel, err.Error())
 		}
 	}
 
diff --git a/src/cmd/tools/zarf.go b/src/cmd/tools/zarf.go
index 403f97c105..efcdbbd2ab 100644
--- a/src/cmd/tools/zarf.go
+++ b/src/cmd/tools/zarf.go
@@ -7,12 +7,14 @@ package tools
 import (
 	"fmt"
 	"os"
+	"path/filepath"
 
 	"github.com/AlecAivazis/survey/v2"
 	"github.com/defenseunicorns/zarf/src/config"
 	"github.com/defenseunicorns/zarf/src/config/lang"
 	"github.com/defenseunicorns/zarf/src/internal/cluster"
 	"github.com/defenseunicorns/zarf/src/pkg/message"
+	"github.com/defenseunicorns/zarf/src/pkg/packager"
 	"github.com/defenseunicorns/zarf/src/pkg/pki"
 	"github.com/defenseunicorns/zarf/src/pkg/utils"
 	"github.com/sigstore/cosign/pkg/cosign"
@@ -21,6 +23,7 @@ import (
 
 func init() {
 	var subAltNames []string
+	var outputDirectory string
 
 	readCredsCmd := &cobra.Command{
 		Use:    "get-git-password",
@@ -75,6 +78,20 @@ func init() {
 		},
 	}
 
+	downloadInitCmd := &cobra.Command{
+		Use:   "download-init",
+		Short: lang.CmdToolsDownloadInitShort,
+		Run: func(cmd *cobra.Command, args []string) {
+			initPackageName := packager.GetInitPackageName("")
+			target := filepath.Join(outputDirectory, initPackageName)
+			url := packager.GetInitPackageRemote("")
+			err := utils.DownloadToFile(url, target, "")
+			if err != nil {
+				message.Fatalf(err, lang.CmdToolsDownloadInitErr, err.Error())
+			}
+		},
+	}
+
 	generatePKICmd := &cobra.Command{
 		Use:     "gen-pki {HOST}",
 		Aliases: []string{"pki"},
@@ -173,6 +190,9 @@ func init() {
 	toolsCmd.AddCommand(clearCacheCmd)
 	clearCacheCmd.Flags().StringVar(&config.CommonOptions.CachePath, "zarf-cache", config.ZarfDefaultCachePath, lang.CmdToolsClearCacheFlagCachePath)
 
+	toolsCmd.AddCommand(downloadInitCmd)
+	downloadInitCmd.Flags().StringVarP(&outputDirectory, "output-directory", "o", "", lang.CmdToolsDownloadInitFlagOutputDirectory)
+
 	toolsCmd.AddCommand(generatePKICmd)
 	generatePKICmd.Flags().StringArrayVar(&subAltNames, "sub-alt-name", []string{}, lang.CmdToolsGenPkiFlagAltName)
 
diff --git a/src/config/lang/english.go b/src/config/lang/english.go
index 4258b3e44f..b7faefea54 100644
--- a/src/config/lang/english.go
+++ b/src/config/lang/english.go
@@ -34,7 +34,7 @@ const (
 		"using a declarative packaging strategy to support DevSecOps in offline and semi-connected environments."
 
 	RootCmdFlagLogLevel    = "Log level when running Zarf. Valid options are: warn, info, debug, trace"
-	RootCmdFlagArch        = "Architecture for OCI images"
+	RootCmdFlagArch        = "Architecture for OCI images and Zarf packages"
 	RootCmdFlagSkipLogFile = "Disable log file creation"
 	RootCmdFlagNoProgress  = "Disable fancy UI progress bars, spinners, logos, etc"
 	RootCmdFlagCachePath   = "Specify the location of the Zarf cache directory"
@@ -129,7 +129,7 @@ zarf init --git-push-password={PASSWORD} --git-push-username={USERNAME} --git-ur
 	CmdInitDownloadAsk       = "It seems the init package could not be found locally, but can be downloaded from %s"
 	CmdInitDownloadNote      = "Note: This will require an internet connection."
 	CmdInitDownloadConfirm   = "Do you want to download this init package?"
-	CmdInitDownloadCancel    = "confirm selection canceled: %s"
+	CmdInitDownloadErrCancel = "confirm selection canceled: %s"
 	CmdInitDownloadErrManual = "download the init package manually and place it in the current working directory"
 
 	CmdInitFlagSet = "Specify deployment variables to set on the command line (KEY=value)"
@@ -290,6 +290,10 @@ zarf init --git-push-password={PASSWORD} --git-push-username={USERNAME} --git-ur
 	CmdToolsClearCacheSuccess       = "Successfully cleared the cache from %s"
 	CmdToolsClearCacheFlagCachePath = "Specify the location of the Zarf artifact cache (images and git repositories)"
 
+	CmdToolsDownloadInitShort               = "Download the init package for the current Zarf version into the specified directory."
+	CmdToolsDownloadInitFlagOutputDirectory = "Specify a directory to place the init package in."
+	CmdToolsDownloadInitErr                 = "Unable to download the init package: %s"
+
 	CmdToolsGenPkiShort       = "Generates a Certificate Authority and PKI chain of trust for the given host"
 	CmdToolsGenPkiSuccess     = "Successfully created a chain of trust for %s"
 	CmdToolsGenPkiFlagAltName = "Specify Subject Alternative Names for the certificate"
diff --git a/src/pkg/packager/common.go b/src/pkg/packager/common.go
index 15c202a48a..fa069e8f23 100644
--- a/src/pkg/packager/common.go
+++ b/src/pkg/packager/common.go
@@ -119,6 +119,11 @@ func (p *Packager) GetPackageName() string {
 	return fmt.Sprintf("%s.%s", packageFileName, suffix)
 }
 
+// GetInitPackageRemote returns the URL for a remote init package for the given architecture
+func GetInitPackageRemote(arch string) string {
+	return fmt.Sprintf("https://github.com/%s/releases/download/%s/%s", config.GithubProject, config.CLIVersion, GetInitPackageName(arch))
+}
+
 // ClearTempPaths removes the temp directory and any files within it.
 func (p *Packager) ClearTempPaths() {
 	// Remove the temp directory, but don't throw an error if it fails
diff --git a/src/pkg/utils/network.go b/src/pkg/utils/network.go
index 32794603c2..d421a77510 100644
--- a/src/pkg/utils/network.go
+++ b/src/pkg/utils/network.go
@@ -97,7 +97,7 @@ func DownloadToFile(src string, dst string, cosignKeyPath string) (err error) {
 		return err
 	}
 
-	err = os.MkdirAll(filepath.Dir(dst), 0600)
+	err = CreateDirectory(filepath.Dir(dst), 0700)
 	if err != nil {
 		return fmt.Errorf(lang.ErrCreatingDir, filepath.Dir(dst), err.Error())
 	}