diff --git a/tools/d2/d2.test.ts b/tools/d2/d2.test.ts
new file mode 100644
index 000000000..031d297af
--- /dev/null
+++ b/tools/d2/d2.test.ts
@@ -0,0 +1,6 @@
+import { toolInstallTest } from "tests";
+
+toolInstallTest({
+  toolName: "d2",
+  toolVersion: "0.7.1",
+});
diff --git a/tools/d2/plugin.yaml b/tools/d2/plugin.yaml
new file mode 100644
index 000000000..9018f8ef9
--- /dev/null
+++ b/tools/d2/plugin.yaml
@@ -0,0 +1,29 @@
+version: 0.1
+downloads:
+  - name: d2
+    downloads:
+      # Every platform ships a tarball (windows included; the .msi is skipped).
+      # The archive holds `d2-v${version}/bin/d2`, so one level is stripped and the
+      # nested `bin` is added to PATH rather than stripping two levels, which would
+      # discard the bundled LICENSE/man files.
+      - os:
+          linux: linux
+          macos: macos
+          windows: windows
+        cpu:
+          x86_64: amd64
+          arm_64: arm64
+        url: https://github.com/terrastruct/d2/releases/download/v${version}/d2-v${version}-${os}-${cpu}.tar.gz
+        strip_components: 1
+tools:
+  definitions:
+    - name: d2
+      download: d2
+      known_good_version: 0.7.1
+      environment:
+        - name: PATH
+          list: ["${tool}/bin"]
+      shims: [d2]
+      health_checks:
+        - command: d2 --version
+          parse_regex: ${semver}
diff --git a/tools/jj/jj.test.ts b/tools/jj/jj.test.ts
new file mode 100644
index 000000000..c2c46d5e3
--- /dev/null
+++ b/tools/jj/jj.test.ts
@@ -0,0 +1,6 @@
+import { toolInstallTest } from "tests";
+
+toolInstallTest({
+  toolName: "jj",
+  toolVersion: "0.45.1",
+});
diff --git a/tools/jj/plugin.yaml b/tools/jj/plugin.yaml
new file mode 100644
index 000000000..7f47652eb
--- /dev/null
+++ b/tools/jj/plugin.yaml
@@ -0,0 +1,32 @@
+version: 0.1
+downloads:
+  - name: jj
+    downloads:
+      # Note the target-triple order: `${cpu}-${os}`, not `${os}-${cpu}`.
+      # The archives hold `jj` at their root alongside README/LICENSE, so there is
+      # nothing to strip.
+      - os:
+          linux: unknown-linux-musl
+          macos: apple-darwin
+        cpu:
+          x86_64: x86_64
+          arm_64: aarch64
+        url: https://github.com/jj-vcs/jj/releases/download/v${version}/jj-v${version}-${cpu}-${os}.tar.gz
+      - os:
+          windows: pc-windows-msvc
+        cpu:
+          x86_64: x86_64
+          arm_64: aarch64
+        url: https://github.com/jj-vcs/jj/releases/download/v${version}/jj-v${version}-${cpu}-${os}.zip
+tools:
+  definitions:
+    - name: jj
+      download: jj
+      known_good_version: 0.45.1
+      shims: [jj]
+      health_checks:
+        # Release binaries report `jj <version>-<commit sha>`, so `${semver}`
+        # would capture the sha as a prerelease suffix and never match the
+        # enabled version. Capture just the `x.y.z` prefix.
+        - command: jj --version
+          parse_regex: jj (\d+\.\d+\.\d+)
diff --git a/tools/nx/nx.test.ts b/tools/nx/nx.test.ts
new file mode 100644
index 000000000..fe4fc1c20
--- /dev/null
+++ b/tools/nx/nx.test.ts
@@ -0,0 +1,6 @@
+import { toolInstallTest } from "tests";
+
+toolInstallTest({
+  toolName: "nx",
+  toolVersion: "22.5.3",
+});
diff --git a/tools/nx/plugin.yaml b/tools/nx/plugin.yaml
new file mode 100644
index 000000000..bbd907693
--- /dev/null
+++ b/tools/nx/plugin.yaml
@@ -0,0 +1,13 @@
+version: 0.1
+tools:
+  definitions:
+    - name: nx
+      runtime: node
+      package: nx
+      known_good_version: 22.5.3
+      shims: [nx]
+      health_checks:
+        # `nx --version` reports both the workspace-local and the global version;
+        # outside a workspace only the global one is a semver.
+        - command: nx --version
+          parse_regex: ${semver}
diff --git a/tools/pulumi/plugin.yaml b/tools/pulumi/plugin.yaml
new file mode 100644
index 000000000..b0cbe4f1a
--- /dev/null
+++ b/tools/pulumi/plugin.yaml
@@ -0,0 +1,31 @@
+version: 0.1
+downloads:
+  - name: pulumi
+    downloads:
+      # The unix archives hold `pulumi/<binary>`, so one level is stripped to land
+      # the CLI and its bundled language/resource plugins at the tool root.
+      - os:
+          linux: linux
+          macos: darwin
+        cpu:
+          x86_64: x64
+          arm_64: arm64
+        url: https://get.pulumi.com/releases/sdk/pulumi-v${version}-${os}-${cpu}.tar.gz
+        strip_components: 1
+      # The windows zip nests one level deeper (`pulumi/bin/pulumi.exe`).
+      - os:
+          windows: windows
+        cpu:
+          x86_64: x64
+          arm_64: arm64
+        url: https://get.pulumi.com/releases/sdk/pulumi-v${version}-${os}-${cpu}.zip
+        strip_components: 2
+tools:
+  definitions:
+    - name: pulumi
+      download: pulumi
+      known_good_version: 3.210.0
+      shims: [pulumi]
+      health_checks:
+        - command: pulumi version
+          parse_regex: ${semver}
diff --git a/tools/pulumi/pulumi.test.ts b/tools/pulumi/pulumi.test.ts
new file mode 100644
index 000000000..790cba80e
--- /dev/null
+++ b/tools/pulumi/pulumi.test.ts
@@ -0,0 +1,6 @@
+import { toolInstallTest } from "tests";
+
+toolInstallTest({
+  toolName: "pulumi",
+  toolVersion: "3.210.0",
+});