diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 42b4617..2ca9fb2 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -52,35 +52,23 @@ jobs:
           files: ahfail-linux-x86_64.tar.gz
 
       - name: Update Homebrew tap
-        # git over HTTP is disabled on this Gitea on purpose, so the formula is
-        # updated through the contents API instead of a clone and push.
+        # The tap lives on GitHub (asger-weirsoee/homebrew-tap): Homebrew cannot
+        # clone from this Gitea, where git over HTTP is disabled. The deploy key
+        # can write only to that one repository; the tap's Actions then build
+        # and test the formula on a real Mac.
         env:
-          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          HOMEBREW_TAP_DEPLOY_KEY: ${{ secrets.HOMEBREW_TAP_DEPLOY_KEY }}
           TAG: ${{ github.ref_name }}
-          API: ${{ github.server_url }}/api/v1/repos/agw/homebrew-ahfail/contents/Formula/ahfail.rb
         run: |
-          python3 - <<'PY'
-          import base64, json, os, re, urllib.request
-
-          api, token, tag = os.environ["API"], os.environ["RELEASE_TOKEN"], os.environ["TAG"]
-          sha256 = os.environ["SOURCE_SHA256"]
-          headers = {"Authorization": f"token {token}", "Content-Type": "application/json"}
-
-          with urllib.request.urlopen(urllib.request.Request(api, headers=headers)) as r:
-              current = json.load(r)
-          formula = base64.b64decode(current["content"]).decode()
-          new = re.sub(r'url ".*?"', f'url "https://gitea.weircon.dk/agw/gtk-ahfail/archive/{tag}.tar.gz"', formula, count=1)
-          new = re.sub(r'sha256 ".*?"', f'sha256 "{sha256}"', new, count=1)
-          if new == formula:
-              print("formula already up to date")
-              raise SystemExit(0)
-
-          body = json.dumps({
-              "content": base64.b64encode(new.encode()).decode(),
-              "sha": current["sha"],
-              "message": f"chore: update ahfail to {tag}",
-          }).encode()
-          req = urllib.request.Request(api, data=body, headers=headers, method="PUT")
-          with urllib.request.urlopen(req) as r:
-              print("formula updated:", r.status)
-          PY
+          set -euo pipefail
+          mkdir -p ~/.ssh
+          printf '%s\n' "$HOMEBREW_TAP_DEPLOY_KEY" > ~/.ssh/tap
+          chmod 600 ~/.ssh/tap
+          export GIT_SSH_COMMAND="ssh -i ~/.ssh/tap -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new"
+          git clone -q git@github.com:asger-weirsoee/homebrew-tap.git tap
+          cd tap
+          URL="https://gitea.weircon.dk/agw/gtk-ahfail/archive/${TAG}.tar.gz"
+          sed -i "s|^  url \".*\"|  url \"$URL\"|; s|^  sha256 \".*\"|  sha256 \"${SOURCE_SHA256}\"|" Formula/ahfail.rb
+          if git diff --quiet; then echo "formula already up to date"; exit 0; fi
+          git -c user.name="Asger Geel Weirsøe" -c user.email="github@weircon.dk" commit -q -am "ahfail ${TAG#v}"
+          git push -q origin HEAD
diff --git a/readme.md b/readme.md
index 92e020f..9d73610 100644
--- a/readme.md
+++ b/readme.md
@@ -81,7 +81,7 @@ Pass `--no-max-volume` to leave the volume alone.
 ### Homebrew (recommended)
 
 ```bash
-brew tap agw/ahfail https://gitea.weircon.dk/agw/homebrew-ahfail
+brew tap asger-weirsoee/tap
 brew install ahfail
 ```