diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index ce6efd73..2ec35a1f 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -104,17 +104,14 @@ homebrew_casks:
       bash: completions/lstk.bash
       zsh: completions/lstk.zsh
       fish: completions/lstk.fish
-    # hooks.post.install emits Homebrew's deprecated `postflight`; the
-    # replacement arrives as hooks.post.install_steps in GoReleaser v2.19
-    # (goreleaser/goreleaser#6873). Until then custom_block writes the stanza,
-    # escaping `{{staged_path}}` past GoReleaser's template pass. It renders
-    # first in the cask, so `brew style` reports stanza-order offences.
-    custom_block: |
-      postflight_steps do
-        on_macos do
-          # The whole staged dir, not only lstk: the bundled extensions binary
-          # sits next to it and would otherwise be blocked by Gatekeeper on its
-          # first run.
-          run "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "{{ "{{staged_path}}" }}"]
-        end
-      end
+    hooks:
+      post:
+        # `.StagedPath` is GoReleaser's field; it renders to Homebrew's own
+        # `{{staged_path}}` token, which resolves at install time.
+        install_steps: |
+          on_macos do
+            # The whole staged dir, not only lstk: the bundled extensions binary
+            # sits next to it and would otherwise be blocked by Gatekeeper on its
+            # first run.
+            run "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "{{ .StagedPath }}"]
+          end
diff --git a/.tool-versions b/.tool-versions
index 1ec38e18..42a9919f 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1,2 +1,2 @@
 golangci-lint 2.14.0
-goreleaser 2.18.2
+goreleaser 2.19.0
diff --git a/scripts/check-cask.sh b/scripts/check-cask.sh
index 80f00d19..dcf30414 100755
--- a/scripts/check-cask.sh
+++ b/scripts/check-cask.sh
@@ -54,9 +54,8 @@ grep -q 'postflight_steps do' "$CASK" ||
 grep -q 'com.apple.quarantine' "$CASK" ||
   fail "cask no longer clears com.apple.quarantine"
 
-# Homebrew's tokens share GoReleaser's delimiters. An unescaped
-# `{{staged_path}}` fails the release; a broken escape emits a literal pointing
-# somewhere else.
+# `.StagedPath` must reach the cask as Homebrew's `{{staged_path}}` token; a
+# hard-coded or Ruby-interpolated path would miss the staged dir.
 grep -q '"{{staged_path}}"' "$CASK" ||
   fail "quarantine step does not target the whole staged dir"
 
diff --git a/scripts/lint-cask.sh b/scripts/lint-cask.sh
index 356739f1..02bb63cd 100755
--- a/scripts/lint-cask.sh
+++ b/scripts/lint-cask.sh
@@ -33,10 +33,7 @@ TAP_CASKS="$(brew --repository "$TAP")/Casks"
 mkdir -p "$TAP_CASKS"
 cp "$CASK" "$TAP_CASKS/lstk.rb"
 
-# TODO(#512): drop --except-cops once hooks.post.install_steps replaces
-# custom_block, which renders the stanza first and trips Cask/StanzaOrder on
-# everything after it. Scoped to that cop so the deprecation cops still fire.
-brew style --except-cops=Cask/StanzaOrder "$TAP_CASKS/lstk.rb"
+brew style "$TAP_CASKS/lstk.rb"
 
 # Passes on a deprecated stanza, so this guards other faults, not #501. Its
 # `--online` form checks urls and checksums, but only the tap has a published