diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f8d1c39..bb890ec 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,7 +5,8 @@ on:
     tags:
       - '*'
 
-# Least privilege: goreleaser only needs to create the release / upload assets.
+# Least privilege for the release repository. Publishing to the separate
+# Homebrew tap uses HOMEBREW_TAP_GITHUB_TOKEN below.
 permissions:
   contents: write
 
@@ -29,10 +30,12 @@ jobs:
         env:
           APP_ID: ${{ secrets.APP_ID }}
           APP_HASH: ${{ secrets.APP_HASH }}
+          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
         run: |
           missing=
           [ -n "$APP_ID" ] || missing="$missing APP_ID"
           [ -n "$APP_HASH" ] || missing="$missing APP_HASH"
+          [ -n "$HOMEBREW_TAP_GITHUB_TOKEN" ] || missing="$missing HOMEBREW_TAP_GITHUB_TOKEN"
           if [ -n "$missing" ]; then
             echo "::error::Missing required release secret(s):$missing. Set them with: gh secret set <NAME>"
             exit 1
@@ -53,6 +56,8 @@ jobs:
           # tdesktop fallback.
           APP_ID: ${{ secrets.APP_ID }}
           APP_HASH: ${{ secrets.APP_HASH }}
+          # Cross-repository publishing cannot use GITHUB_TOKEN.
+          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
 
       - name: Upload assets
         uses: actions/upload-artifact@v7.0.1
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 784be52..0df5fe4 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -53,4 +53,21 @@ nfpms:
     formats:
       - apk
       - deb
-      - rpm
\ No newline at end of file
+      - rpm
+homebrew_casks:
+  - name: tg
+    binaries:
+      - tg
+    homepage: https://github.com/gotd/cli
+    description: Telegram CLI for humans and agents
+    hooks:
+      post:
+        install: |
+          if OS.mac?
+            system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/tg"]
+          end
+    repository:
+      owner: gotd
+      name: homebrew-tap
+      branch: main
+      token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
diff --git a/README.md b/README.md
index d45d008..38a5112 100644
--- a/README.md
+++ b/README.md
@@ -9,8 +9,21 @@ Built on [`gotd/td`](https://github.com/gotd/td).
 
 ## Installation
 
-Download a prebuilt binary or package (`.deb`/`.rpm`/`.apk`) for your platform from
-the [latest release](https://github.com/gotd/cli/releases/latest).
+Install with Homebrew:
+
+```console
+$ brew install --cask gotd/tap/tg
+```
+
+GoReleaser updates the tap when a new version is published, so future updates
+use the regular Homebrew flow:
+
+```console
+$ brew upgrade tg
+```
+
+Alternatively, download a prebuilt binary or package (`.deb`/`.rpm`/`.apk`) for
+your platform from the [latest release](https://github.com/gotd/cli/releases/latest).
 
 ## Quick start