diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index e173a9d..923a256 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -40,6 +40,15 @@ jobs:
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
         run: bash scripts/setup-macos-signing.sh
+      -
+        name: Mint tap token
+        id: tap-token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          app-id: ${{ vars.HOMEBREW_TAP_APP_ID }}
+          private-key: ${{ secrets.HOMEBREW_TAP_APP_PRIVATE_KEY }}
+          owner: tailscale
+          repositories: homebrew-tap
       -
         name: Run GoReleaser
         uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a #v6.4.0
@@ -49,6 +58,8 @@ jobs:
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # GITHUB_TOKEN is scoped to this repo only; the tap needs the App token.
+          HOMEBREW_TAP_TOKEN: ${{ steps.tap-token.outputs.token }}
       -
         name: Tear down signing keychain
         if: always()
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 93599d1..1ff0880 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -49,3 +49,20 @@ changelog:
       - "^docs:"
       - "^test:"
       - "^chore:"
+
+# Pushes the formula straight to the tap's default branch (no PR) once the
+# signed archives are uploaded, so the sha256 values are the notarized ones.
+brews:
+  - name: aperture-cli
+    repository:
+      owner: tailscale
+      name: homebrew-tap
+      token: "{{ .Env.HOMEBREW_TAP_TOKEN }}"
+    directory: Formula
+    homepage: https://github.com/tailscale/aperture-cli
+    description: Agentic coding launcher for Aperture by Tailscale
+    license: BSD-3-Clause
+    commit_author:
+      use_github_app_token: true
+    test: |
+      assert_match version.to_s, shell_output("#{bin}/aperture --version")
diff --git a/install.sh b/install.sh
index b687c1d..83b92e5 100755
--- a/install.sh
+++ b/install.sh
@@ -81,4 +81,4 @@ fi
 $sudo mkdir -p "$INSTALL_DIR"
 $sudo install -m 0755 "$bin" "$INSTALL_DIR/aperture"
 
-echo "==> Installed $("$INSTALL_DIR/aperture" -version | head -1) to $INSTALL_DIR/aperture"
+echo "==> Installed $("$INSTALL_DIR/aperture" --version | head -1) to $INSTALL_DIR/aperture"
diff --git a/scripts/sign_macos_test.go b/scripts/sign_macos_test.go
index 845b27b..9426da0 100644
--- a/scripts/sign_macos_test.go
+++ b/scripts/sign_macos_test.go
@@ -176,3 +176,20 @@ case "$tool $1" in
     ;;
 esac
 `
+
+// install.sh reports the version of what it just installed. It has to use the
+// GNU form: the single-dash long form is deprecated, so it both prints a
+// deprecation warning on stderr and would greet every fresh install with a
+// notice about a flag the user never typed.
+func TestInstallScriptReportsVersionInGNUForm(t *testing.T) {
+	script, err := os.ReadFile("../install.sh")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(string(script), " -version") {
+		t.Error("install.sh calls the installed binary with the deprecated -version form")
+	}
+	if !strings.Contains(string(script), `aperture" --version`) {
+		t.Error("install.sh no longer reports the installed version")
+	}
+}