diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 60f9561efa..8f36a7911b 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -476,8 +476,12 @@ tarball-create:
   <<: *base_image
   <<: *default_triggering_rules
   script:
-    - *configure
+    - ./configure --enable-maintainer-mode
+    - make maintainer-clean
+    - autoreconf -fi
+    - ./configure --enable-maintainer-mode
     - make -j${BUILD_PARALLEL_JOBS:-1} all V=1
+    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
     - make -j${BUILD_PARALLEL_JOBS:-1} dist V=1
   artifacts:
     paths:
diff --git a/doc/man/dnssec-importkey.1in b/doc/man/dnssec-importkey.1in
index 174c25c2a3..619e5edade 100644
--- a/doc/man/dnssec-importkey.1in
+++ b/doc/man/dnssec-importkey.1in
@@ -39,7 +39,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .sp
 \fBdnssec\-importkey\fP reads a public DNSKEY record and generates a pair
 of .key/.private files. The DNSKEY record may be read from an existing
-\&.key file, in which case a corresponding .private file is
+.key file, in which case a corresponding .private file is
 generated, or it may be read from any other file or from the standard
 input, in which case both .key and .private files are generated.
 .sp
diff --git a/doc/man/tsig-keygen.8in b/doc/man/tsig-keygen.8in
index 4023cf146d..6af3f9b76e 100644
--- a/doc/man/tsig-keygen.8in
+++ b/doc/man/tsig-keygen.8in
@@ -32,7 +32,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 ..
 .SH SYNOPSIS
 .sp
-\fBtsig\-keygen\fP [\fB\-a\fP algorithm] [\fB\-h\fP] [\fB\-r\fP randomfile] [\fB\-s\fP name]
+\fBtsig\-keygen\fP [\fB\-a\fP algorithm] [\fB\-h\fP] [\fB\-r\fP randomfile] [name]
 .sp
 \fBddns\-confgen\fP [\fB\-a\fP algorithm] [\fB\-h\fP] [\fB\-k\fP keyname] [\fB\-q\fP] [\fB\-r\fP randomfile] [\fB\-s\fP name] [\fB\-z\fP zone]
 .SH DESCRIPTION