diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1c88ad7..1f02b6e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,4 +1,4 @@
-name: goreleaser
+name: release
 
 on:
   push:
@@ -6,8 +6,13 @@ on:
       - "*"
 
 jobs:
-  goreleaser:
+  release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: write
+      id-token: write
+      attestations: write
     steps:
       - name: Checkout
         uses: actions/checkout@v7
@@ -24,4 +29,18 @@ jobs:
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v4
+        with:
+          subject-path: |
+            dist/*.zip
+            dist/*_SHA256SUMS
+            dist/*/vssh
+            dist/*/vssh.exe
+      - name: Set up gobottle
+        uses: isometry/gobottle-setup@v1
+      - name: Publish bottles
+        run: gobottle release --source local
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GOBOTTLE_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
diff --git a/.gobottle.yaml b/.gobottle.yaml
new file mode 100644
index 0000000..c063a13
--- /dev/null
+++ b/.gobottle.yaml
@@ -0,0 +1,15 @@
+formula:
+  description: Automatically use HashiCorp Vault SSH Client Key Signing with ssh(1)
+  homepage: https://just.breathe.io/project/vault-ssh-plus/
+  license: MIT
+  # gobottle renders dependencies as plain (required) depends_on lines;
+  # vault stays a runtime suggestion via caveats rather than a hard dependency
+  caveats: |
+    vssh requires the vault binary to be in your PATH.
+    You can install it with:
+      brew install hashicorp/tap/vault
+
+source:
+  type: local
+
+binaries: [vssh]
diff --git a/.goreleaser.yml b/.goreleaser.yml
index 24a0e50..8e16c9b 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -22,10 +22,10 @@ builds:
       - arm64
     binary: vssh
 archives:
-  - format: zip
+  - formats: [zip]
     name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
 snapshot:
-  name_template: "{{ .Tag }}-next"
+  version_template: "{{ .Tag }}-next"
 checksum:
   name_template: "{{ .ProjectName }}_{{ .Version }}_SHA256SUMS"
   algorithm: sha256
@@ -37,22 +37,3 @@ changelog:
     exclude:
       - "^docs:"
       - "^test:"
-brews:
-  - repository:
-      owner: isometry
-      name: homebrew-tap
-      token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
-    directory: Formula
-    description: Automatically use HashiCorp Vault SSH Client Key Signing with ssh(1)
-    homepage: https://just.breathe.io/project/vault-ssh-plus/
-    caveats: |
-      vssh requires the vault binary to be in your PATH.
-      You can install it with:
-        brew install hashicorp/tap/vault
-    dependencies:
-      - name: hashicorp/tap/vault
-        type: optional
-    test: |
-      system "#{bin}/vssh --version"
-    install: |
-      bin.install "vssh"
diff --git a/README.md b/README.md
index b03518b..5648f01 100644
--- a/README.md
+++ b/README.md
@@ -92,9 +92,10 @@ uid=0(root) gid=0(wheel) groups=0(wheel),5(operator)
 
 Download and extract the [latest release](https://github.com/isometry/vault-ssh-plus/releases/latest).
 
-### macOS
+### Homebrew (macOS/Linux)
 
 ```sh
+brew trust isometry/tap  # required once on Homebrew ≥6
 brew install isometry/tap/vault-ssh-plus
 ```