diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index df582cd..e3c3f8c 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -45,6 +45,49 @@ archives:
 checksum:
   name_template: 'checksums.txt'
 
+brews:
+  - name: docker-credential-atcr
+    ids:
+      - credential-helper
+    repository:
+      # DID-based owner keeps this stable across Tangled handle renames.
+      # Replace TAP_REPO_DID with the did:plc of the tap repo once created.
+      owner: 'did:plc:TAP_REPO_DID'
+      name: homebrew-tap
+      branch: main
+      git:
+        url: 'git@knot1.tangled.sh:did:plc:TAP_REPO_DID/homebrew-tap'
+        private_key: '{{ .Env.TAP_SSH_KEY }}'
+    directory: Formula
+    url_template: "https://tangled.org/evan.jarrett.net/at-container-registry/tags/v{{ .Version }}/download/{{ .ArtifactName }}"
+    homepage: "https://atcr.io"
+    description: "Docker credential helper for ATCR (ATProto Container Registry)"
+    license: "MIT"
+    commit_author:
+      name: atcr-bot
+      email: releases@atcr.io
+    commit_msg_template: "Brew formula update for {{ .ProjectName }} version {{ .Tag }}"
+    install: |
+      bin.install "docker-credential-atcr"
+    test: |
+      assert_match version.to_s, shell_output("#{bin}/docker-credential-atcr version 2>&1")
+    caveats: |
+      To finish setup, run:
+        docker-credential-atcr configure-docker
+
+      This writes the credential helper entry to ~/.docker/config.json. Or
+      add manually:
+        {
+          "credHelpers": {
+            "atcr.io": "atcr"
+          }
+        }
+
+      Then push an image to trigger device authorization:
+        docker push atcr.io/<your-handle>/<image>:latest
+
+      Credentials live in ~/.atcr/device.json (0600).
+
 snapshot:
   version_template: "{{ incpatch .Version }}-next"
 
diff --git a/Formula/docker-credential-atcr.rb b/Formula/docker-credential-atcr.rb
deleted file mode 100644
index b45ac17..0000000
--- a/Formula/docker-credential-atcr.rb
+++ /dev/null
@@ -1,59 +0,0 @@
-# typed: false
-# frozen_string_literal: true
-
-class DockerCredentialAtcr < Formula
-  desc "Docker credential helper for ATCR (ATProto Container Registry)"
-  homepage "https://atcr.io"
-  version "0.0.1"
-  license "MIT"
-
-  on_macos do
-    on_arm do
-      url "https://tangled.org/evan.jarrett.net/at-container-registry/tags/v0.0.1/download/docker-credential-atcr_0.0.1_Darwin_arm64.tar.gz"
-      sha256 "REPLACE_WITH_SHA256"
-    end
-    on_intel do
-      url "https://tangled.org/evan.jarrett.net/at-container-registry/tags/v0.0.1/download/docker-credential-atcr_0.0.1_Darwin_x86_64.tar.gz"
-      sha256 "REPLACE_WITH_SHA256"
-    end
-  end
-
-  on_linux do
-    on_arm do
-      url "https://tangled.org/evan.jarrett.net/at-container-registry/tags/v0.0.1/download/docker-credential-atcr_0.0.1_Linux_arm64.tar.gz"
-      sha256 "REPLACE_WITH_SHA256"
-    end
-    on_intel do
-      url "https://tangled.org/evan.jarrett.net/at-container-registry/tags/v0.0.1/download/docker-credential-atcr_0.0.1_Linux_x86_64.tar.gz"
-      sha256 "REPLACE_WITH_SHA256"
-    end
-  end
-
-  def install
-    bin.install "docker-credential-atcr"
-  end
-
-  test do
-    assert_match version.to_s, shell_output("#{bin}/docker-credential-atcr version 2>&1")
-  end
-
-  def caveats
-    <<~EOS
-      To configure Docker to use ATCR credential helper, add the following
-      to your ~/.docker/config.json:
-
-        {
-          "credHelpers": {
-            "atcr.io": "atcr"
-          }
-        }
-
-      Or run: docker-credential-atcr configure-docker
-
-      To authenticate with ATCR:
-        docker push atcr.io/<your-handle>/<image>:latest
-
-      Configuration is stored in: ~/.atcr/config.json
-    EOS
-  end
-end
diff --git a/INSTALLATION.md b/INSTALLATION.md
index 8038d70..a77ca21 100644
--- a/INSTALLATION.md
+++ b/INSTALLATION.md
@@ -40,8 +40,9 @@ Invoke-WebRequest -Uri https://atcr.io/install.ps1 -OutFile install.ps1
 ### Using Homebrew (macOS and Linux)
 
 ```bash
-# Add the ATCR tap
-brew tap atcr-io/tap
+# Add the ATCR tap (hosted on Tangled, so pass the URL explicitly).
+# DID-based URL is stable across any future handle rename.
+brew tap atcr/tap https://tangled.org/did:plc:TAP_REPO_DID/homebrew-tap
 
 # Install the credential helper
 brew install docker-credential-atcr
@@ -55,7 +56,7 @@ Homebrew will automatically download the correct binary for your platform.
 
 ### Manual Installation
 
-1. **Download the binary** for your platform from [GitHub Releases](https://github.com/atcr-io/atcr/releases)
+1. **Download the binary** for your platform from [Tangled tags](https://tangled.org/evan.jarrett.net/at-container-registry/tags)
 
    - Linux amd64: `docker-credential-atcr_VERSION_Linux_x86_64.tar.gz`
    - Linux arm64: `docker-credential-atcr_VERSION_Linux_arm64.tar.gz`
diff --git a/scripts/update-homebrew-formula.sh b/scripts/update-homebrew-formula.sh
deleted file mode 100755
index 7fded6e..0000000
--- a/scripts/update-homebrew-formula.sh
+++ /dev/null
@@ -1,221 +0,0 @@
-#!/usr/bin/env bash
-#
-# update-homebrew-formula.sh - Update Homebrew formula after a GoReleaser release
-#
-# Usage: ./scripts/update-homebrew-formula.sh <version> [--push]
-#
-# Example: ./scripts/update-homebrew-formula.sh v0.0.2
-#          ./scripts/update-homebrew-formula.sh v0.0.2 --push
-#
-# This script:
-# 1. Downloads pre-built archives from Tangled for each platform
-# 2. Computes SHA256 checksums
-# 3. Generates the updated formula
-# 4. Optionally clones the homebrew-tap repo, commits, and pushes
-#
-# If GoReleaser dist/ directory exists locally, checksums are read from there instead.
-#
-
-set -euo pipefail
-
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-NC='\033[0m'
-
-TANGLED_REPO="https://tangled.org/evan.jarrett.net/at-container-registry"
-TAP_REPO="https://tangled.org/evan.jarrett.net/homebrew-tap"
-BINARY_NAME="docker-credential-atcr"
-FORMULA_PATH="Formula/docker-credential-atcr.rb"
-
-PLATFORMS=(
-    "Darwin_arm64"
-    "Darwin_x86_64"
-    "Linux_arm64"
-    "Linux_x86_64"
-)
-
-if [ $# -lt 1 ]; then
-    echo -e "${RED}Error: Missing required argument${NC}"
-    echo "Usage: $0 <version> [--push]"
-    echo ""
-    echo "Example: $0 v0.0.2"
-    echo "         $0 v0.0.2 --push"
-    exit 1
-fi
-
-VERSION="$1"
-PUSH=false
-if [ "${2:-}" = "--push" ]; then
-    PUSH=true
-fi
-
-# Add 'v' prefix if not present
-if [[ ! "$VERSION" =~ ^v ]]; then
-    VERSION="v${VERSION}"
-fi
-VERSION_NO_V="${VERSION#v}"
-
-echo -e "${GREEN}Updating Homebrew formula for ${VERSION}${NC}"
-echo ""
-
-TEMP_DIR=$(mktemp -d)
-trap 'rm -rf "$TEMP_DIR"' EXIT
-
-# Compute SHA256 for each platform archive
-declare -A CHECKSUMS
-
-sha256_of_file() {
-    if command -v sha256sum &> /dev/null; then
-        sha256sum "$1" | awk '{print $1}'
-    elif command -v shasum &> /dev/null; then
-        shasum -a 256 "$1" | awk '{print $1}'
-    else
-        echo -e "${RED}Error: sha256sum or shasum not found${NC}" >&2
-        exit 1
-    fi
-}
-
-# Check if GoReleaser dist/ has the archives locally
-GORELEASER_DIST="dist"
-if [ -f "${GORELEASER_DIST}/checksums.txt" ]; then
-    echo -e "${YELLOW}Using local GoReleaser dist/ for checksums${NC}"
-    for platform in "${PLATFORMS[@]}"; do
-        archive="${BINARY_NAME}_${VERSION_NO_V}_${platform}.tar.gz"
-        checksum=$(grep "${archive}" "${GORELEASER_DIST}/checksums.txt" | awk '{print $1}')
-        if [ -z "$checksum" ]; then
-            echo -e "${RED}Missing checksum for ${archive} in dist/checksums.txt${NC}"
-            exit 1
-        fi
-        CHECKSUMS[$platform]="$checksum"
-        echo -e "  ${GREEN}✓${NC} ${platform}: ${checksum}"
-    done
-else
-    echo -e "${YELLOW}Downloading archives from Tangled to compute checksums...${NC}"
-    for platform in "${PLATFORMS[@]}"; do
-        archive="${BINARY_NAME}_${VERSION_NO_V}_${platform}.tar.gz"
-        url="${TANGLED_REPO}/tags/${VERSION}/download/${archive}"
-        dest="${TEMP_DIR}/${archive}"
-
-        echo -n "  ${platform}... "
-        if curl -sSfL -o "$dest" "$url"; then
-            CHECKSUMS[$platform]=$(sha256_of_file "$dest")
-            echo -e "${GREEN}✓${NC} ${CHECKSUMS[$platform]}"
-        else
-            echo -e "${RED}✗ Failed to download${NC}"
-            echo "  URL: ${url}"
-            exit 1
-        fi
-    done
-fi
-
-echo ""
-
-# Generate the formula
-FORMULA=$(cat <<RUBY
-# typed: false
-# frozen_string_literal: true
-
-class DockerCredentialAtcr < Formula
-  desc "Docker credential helper for ATCR (ATProto Container Registry)"
-  homepage "https://atcr.io"
-  version "${VERSION_NO_V}"
-  license "MIT"
-
-  on_macos do
-    on_arm do
-      url "${TANGLED_REPO}/tags/${VERSION}/download/${BINARY_NAME}_${VERSION_NO_V}_Darwin_arm64.tar.gz"
-      sha256 "${CHECKSUMS[Darwin_arm64]}"
-    end
-    on_intel do
-      url "${TANGLED_REPO}/tags/${VERSION}/download/${BINARY_NAME}_${VERSION_NO_V}_Darwin_x86_64.tar.gz"
-      sha256 "${CHECKSUMS[Darwin_x86_64]}"
-    end
-  end
-
-  on_linux do
-    on_arm do
-      url "${TANGLED_REPO}/tags/${VERSION}/download/${BINARY_NAME}_${VERSION_NO_V}_Linux_arm64.tar.gz"
-      sha256 "${CHECKSUMS[Linux_arm64]}"
-    end
-    on_intel do
-      url "${TANGLED_REPO}/tags/${VERSION}/download/${BINARY_NAME}_${VERSION_NO_V}_Linux_x86_64.tar.gz"
-      sha256 "${CHECKSUMS[Linux_x86_64]}"
-    end
-  end
-
-  def install
-    bin.install "docker-credential-atcr"
-  end
-
-  test do
-    assert_match version.to_s, shell_output("#{bin}/docker-credential-atcr version 2>&1")
-  end
-
-  def caveats
-    <<~EOS
-      To configure Docker to use ATCR credential helper, add the following
-      to your ~/.docker/config.json:
-
-        {
-          "credHelpers": {
-            "atcr.io": "atcr"
-          }
-        }
-
-      Or run: docker-credential-atcr configure-docker
-
-      To authenticate with ATCR:
-        docker push atcr.io/<your-handle>/<image>:latest
-
-      Configuration is stored in: ~/.atcr/config.json
-    EOS
-  end
-end
-RUBY
-)
-
-# Write to local formula
-echo "$FORMULA" > "${FORMULA_PATH}"
-echo -e "${GREEN}✓ Updated ${FORMULA_PATH}${NC}"
-
-if [ "$PUSH" = true ]; then
-    echo ""
-    echo -e "${YELLOW}Pushing to homebrew-tap repo...${NC}"
-
-    TAP_DIR="${TEMP_DIR}/homebrew-tap"
-    git clone "$TAP_REPO" "$TAP_DIR" 2>/dev/null || {
-        echo -e "${YELLOW}Tap repo not found, initializing new repo${NC}"
-        mkdir -p "$TAP_DIR"
-        cd "$TAP_DIR"
-        git init
-        git remote add origin "$TAP_REPO"
-    }
-
-    mkdir -p "${TAP_DIR}/Formula"
-    cp "${FORMULA_PATH}" "${TAP_DIR}/Formula/"
-
-    cd "$TAP_DIR"
-    git add Formula/docker-credential-atcr.rb
-    git commit -m "Update docker-credential-atcr to ${VERSION}"
-    git push origin HEAD
-
-    echo -e "${GREEN}✓ Pushed to ${TAP_REPO}${NC}"
-else
-    echo ""
-    echo -e "${YELLOW}Next steps:${NC}"
-    echo "1. Review the formula: ${FORMULA_PATH}"
-    echo "2. Push to your homebrew-tap repo on Tangled:"
-    echo "   cd /path/to/homebrew-tap"
-    echo "   cp ${FORMULA_PATH} Formula/"
-    echo "   git add Formula/ && git commit -m 'Update to ${VERSION}' && git push"
-    echo ""
-    echo "Or re-run with --push to do this automatically:"
-    echo "   $0 ${VERSION} --push"
-fi
-
-echo ""
-echo -e "${GREEN}Users can install/upgrade with:${NC}"
-echo "  brew tap atcr/tap ${TAP_REPO}"
-echo "  brew install docker-credential-atcr"
-echo "  brew upgrade docker-credential-atcr"