diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index e3c3f8c..1ba324d 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -50,13 +50,13 @@ brews:
     ids:
       - credential-helper
     repository:
-      # DID-based owner keeps this stable across Tangled handle renames.
-      # Replace TAP_REPO_DID with the did:plc of the tap repo once created.
-      owner: 'did:plc:TAP_REPO_DID'
-      name: homebrew-tap
+      # Tap lives inside the main repo under Formula/. DID-based URL keeps
+      # this stable across any future Tangled handle/domain rename.
+      owner: 'did:plc:pddp4xt5lgnv2qsegbzzs4xg'
+      name: at-container-registry
       branch: main
       git:
-        url: 'git@knot1.tangled.sh:did:plc:TAP_REPO_DID/homebrew-tap'
+        url: 'git@knot1.tangled.sh:did:plc:pddp4xt5lgnv2qsegbzzs4xg/at-container-registry'
         private_key: '{{ .Env.TAP_SSH_KEY }}'
     directory: Formula
     url_template: "https://tangled.org/evan.jarrett.net/at-container-registry/tags/v{{ .Version }}/download/{{ .ArtifactName }}"
diff --git a/Formula/docker-credential-atcr.rb b/Formula/docker-credential-atcr.rb
new file mode 100644
index 0000000..4b4fd62
--- /dev/null
+++ b/Formula/docker-credential-atcr.rb
@@ -0,0 +1,59 @@
+# typed: false
+# frozen_string_literal: true
+
+class DockerCredentialAtcr < Formula
+  desc "Docker credential helper for ATCR (ATProto Container Registry)"
+  homepage "https://atcr.io"
+  version "0.1.2"
+  license "MIT"
+
+  on_macos do
+    on_arm do
+      url "https://tangled.org/evan.jarrett.net/at-container-registry/tags/v#{version}/download/docker-credential-atcr_#{version}_Darwin_arm64.tar.gz"
+      sha256 "938f7de369c1a93f8275b91f238ae6ffca2f304f5bd236208b3398574c853b52"
+    end
+    on_intel do
+      url "https://tangled.org/evan.jarrett.net/at-container-registry/tags/v#{version}/download/docker-credential-atcr_#{version}_Darwin_x86_64.tar.gz"
+      sha256 "3ce955317f52b049ee6c6348c0f758d36a0ed4d52f60f96b20d68798b5830c88"
+    end
+  end
+
+  on_linux do
+    on_arm do
+      url "https://tangled.org/evan.jarrett.net/at-container-registry/tags/v#{version}/download/docker-credential-atcr_#{version}_Linux_arm64.tar.gz"
+      sha256 "be951a136a79be39935ff57f561cfc8f714fa6abfa1b0f81f9ef383e37e6278f"
+    end
+    on_intel do
+      url "https://tangled.org/evan.jarrett.net/at-container-registry/tags/v#{version}/download/docker-credential-atcr_#{version}_Linux_x86_64.tar.gz"
+      sha256 "08965d9177ab993c229e20c1c3a9675caa20bae795c57b37eb9c72127360d4c7"
+    end
+  end
+
+  def install
+    bin.install "docker-credential-atcr"
+  end
+
+  test do
+    assert_match version.to_s, shell_output("#{bin}/docker-credential-atcr version 2>&1")
+  end
+
+  def caveats
+    <<~EOS
+      To finish setup, run:
+        docker-credential-atcr configure-docker
+
+      This writes the credential helper entry to ~/.docker/config.json. Or
+      add manually:
+        {
+          "credHelpers": {
+            "atcr.io": "atcr"
+          }
+        }
+
+      Then push an image to trigger device authorization:
+        docker push atcr.io/<your-handle>/<image>:latest
+
+      Credentials live in ~/.atcr/device.json (0600).
+    EOS
+  end
+end
diff --git a/INSTALLATION.md b/INSTALLATION.md
index a77ca21..91f2a66 100644
--- a/INSTALLATION.md
+++ b/INSTALLATION.md
@@ -40,9 +40,9 @@ Invoke-WebRequest -Uri https://atcr.io/install.ps1 -OutFile install.ps1
 ### Using Homebrew (macOS and Linux)
 
 ```bash
-# Add the ATCR tap (hosted on Tangled, so pass the URL explicitly).
+# Add the ATCR tap (the main repo itself serves as the tap).
 # DID-based URL is stable across any future handle rename.
-brew tap atcr/tap https://tangled.org/did:plc:TAP_REPO_DID/homebrew-tap
+brew tap atcr/tap https://tangled.org/did:plc:pddp4xt5lgnv2qsegbzzs4xg/at-container-registry
 
 # Install the credential helper
 brew install docker-credential-atcr