diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ed5b657..90db2ce 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,4 +26,11 @@ jobs:
           version: "~> v2"
           args: release --clean
         env:
+          # GITHUB_TOKEN is auto-scoped to this repo — used for the
+          # GitHub Release upload.
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # HOMEBREW_TAP_GITHUB_TOKEN is a cross-repo PAT with
+          # contents:write on srcfl/homebrew-tap and
+          # srcfl/scoop-bucket. Used by goreleaser's brews + scoops
+          # publishers. One token covers both — same org.
+          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
diff --git a/.goreleaser.yml b/.goreleaser.yml
index ec411ff..f681f77 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -54,3 +54,44 @@ changelog:
       - "^test:"
       - "^chore:"
       - "Merge pull request"
+
+# Homebrew tap auto-publish.
+#
+# Requires `HOMEBREW_TAP_GITHUB_TOKEN` repo secret on hugin-agent — a
+# fine-grained PAT (or GitHub App installation token) with
+# `contents: write` on both `srcfl/homebrew-tap` and
+# `srcfl/scoop-bucket`. One token covers both publishers because the
+# accounts live in the same org.
+brews:
+  - name: hugin-agent
+    repository:
+      owner: srcfl
+      name: homebrew-tap
+      token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
+    directory: Formula
+    homepage: "https://github.com/srcfl/hugin-agent"
+    description: "Thin local agent for Hugin — scans LAN, talks Modbus, runs Lua drivers"
+    license: "MIT"
+    install: |
+      bin.install "hugin-agent"
+    test: |
+      system "#{bin}/hugin-agent", "--help"
+    commit_author:
+      name: srcfl-release-bot
+      email: release-bot@sourceful.energy
+    commit_msg_template: "hugin-agent: bump to {{ .Tag }}"
+
+# Scoop bucket auto-publish. Same token as the brew tap.
+scoops:
+  - name: hugin-agent
+    repository:
+      owner: srcfl
+      name: scoop-bucket
+      token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
+    homepage: "https://github.com/srcfl/hugin-agent"
+    description: "Thin local agent for Hugin — scans LAN, talks Modbus, runs Lua drivers"
+    license: "MIT"
+    commit_author:
+      name: srcfl-release-bot
+      email: release-bot@sourceful.energy
+    commit_msg_template: "hugin-agent: bump to {{ .Tag }}"