diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4f25f58..99fe0ea 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -278,14 +278,32 @@ jobs:
       contents: read
 
     steps:
+      - name: Create Homebrew release bot token
+        id: homebrew-release-bot
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.PUTIO_RELEASE_BOT_CLIENT_ID }}
+          private-key: ${{ secrets.PUTIO_RELEASE_BOT_PRIVATE_KEY }}
+          owner: putdotio
+          repositories: |
+            putio-cli
+            homebrew-tap
+          permission-contents: write
+
+      - name: Resolve Homebrew release bot user ID
+        id: homebrew-release-bot-user
+        run: echo "user-id=$(gh api "/users/${{ steps.homebrew-release-bot.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: ${{ steps.homebrew-release-bot.outputs.token }}
+
       - name: Release to Homebrew tap
         uses: Justintime50/homebrew-releaser@a62d7a359683bfc047cdb2431f53ee58241464d1 # v3
         with:
           homebrew_owner: putdotio
           homebrew_tap: homebrew-tap
-          github_token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
-          commit_owner: devsputio
-          commit_email: devs@put.io
+          github_token: ${{ steps.homebrew-release-bot.outputs.token }}
+          commit_owner: ${{ steps.homebrew-release-bot.outputs.app-slug }}[bot]
+          commit_email: ${{ steps.homebrew-release-bot-user.outputs.user-id }}+${{ steps.homebrew-release-bot.outputs.app-slug }}[bot]@users.noreply.github.com
           branch: main
           formula_folder: Formula
           install: 'bin.install "putio"'
diff --git a/docs/DISTRIBUTION.md b/docs/DISTRIBUTION.md
index 540171e..978f242 100644
--- a/docs/DISTRIBUTION.md
+++ b/docs/DISTRIBUTION.md
@@ -20,13 +20,13 @@ Release jobs declare the protected GitHub Environment named `release`.
 
 Environment entries:
 
-- secrets: `PUTIO_RELEASE_BOT_PRIVATE_KEY`, `HOMEBREW_TAP_TOKEN`
+- secrets: `PUTIO_RELEASE_BOT_PRIVATE_KEY`
 - variables: `PUTIO_RELEASE_BOT_CLIENT_ID`
 - approval: none; releases are continuous after the `main` gate passes
 - refs: release branch/tag policy constrains what can publish
 - deployment records: disabled with `deployment: false` because this is package publishing, not an app deploy
 
-Release GitHub writes use `putio-release-bot` for version sync commits, `v*` tags, GitHub Releases, and binary asset uploads.
+Release GitHub writes use `putio-release-bot` for version sync commits, `v*` tags, GitHub Releases, binary asset uploads, and Homebrew tap formula commits. The app installation grants Contents read and write access to `putio-cli` and `homebrew-tap`; the Homebrew job mints an installation token scoped to those two repositories.
 
 The npm package uses Trusted Publishing from GitHub Actions. On npm, configure owner `putdotio`, repository `putio-cli`, workflow `ci.yml`, and Environment named `release` for the package.