diff --git a/.gitea/workflows/release-binaries.yml b/.gitea/workflows/release-binaries.yml
index 73be53d..29a006f 100644
--- a/.gitea/workflows/release-binaries.yml
+++ b/.gitea/workflows/release-binaries.yml
@@ -53,6 +53,7 @@ jobs:
           GORELEASER_FORCE_TOKEN: gitea
           GITEA_TOKEN: ${{ secrets.RELEASE_TOKEN }}
           GITEA_API_URL: http://gitea:3000/api/v1
+          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
 
       # GitHub release relaying is handled by .github/workflows/mirror-release.yml,
       # which runs on GitHub Actions when the push mirror delivers the tag and
diff --git a/.gitea/workflows/release-docker.yml b/.gitea/workflows/release-docker.yml
index 5db40b4..a400323 100644
--- a/.gitea/workflows/release-docker.yml
+++ b/.gitea/workflows/release-docker.yml
@@ -35,11 +35,16 @@ jobs:
 
           TAGS="lerkolabs/uptop:${TAG}"
           TAGS="${TAGS},lerkolabs/uptop:sha-${SHORT_SHA}"
+          TAGS="${TAGS},ghcr.io/lerkolabs/uptop:${TAG}"
+          TAGS="${TAGS},ghcr.io/lerkolabs/uptop:sha-${SHORT_SHA}"
           # :latest only for real releases — rc rehearsal tags must not move it
           if [ "${{ github.ref_type }}" = "tag" ]; then
             case "$TAG" in
               *-*) ;;
-              *) TAGS="${TAGS},lerkolabs/uptop:latest" ;;
+              *)
+                TAGS="${TAGS},lerkolabs/uptop:latest"
+                TAGS="${TAGS},ghcr.io/lerkolabs/uptop:latest"
+                ;;
             esac
           fi
           echo "tags=$TAGS" >> "$GITHUB_OUTPUT"
@@ -56,6 +61,13 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ secrets.GHCR_USERNAME }}
+          password: ${{ secrets.GHCR_TOKEN }}
+
       # Scan must gate the push: build amd64 locally, scan it, and only then run
       # the multi-arch push (amd64 layers come from the builder cache, so the
       # second build only adds the arm64 work).
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 88dc631..d65b920 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -59,6 +59,24 @@ nfpms:
         dst: /usr/share/doc/uptop/LICENSE
         type: doc
 
+brews:
+  - name: uptop
+    repository:
+      owner: lerkolabs
+      name: homebrew-tap
+      token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
+    url_template: "https://github.com/lerkolabs/uptop/releases/download/{{ .Tag }}/{{ .ArtifactName }}"
+    commit_author:
+      name: lerkolabs-bot
+      email: bot@lerkolabs.com
+    homepage: https://github.com/lerkolabs/uptop
+    description: Self-hosted uptime monitoring with a TUI over SSH
+    license: MIT
+    install: |
+      bin.install "uptop"
+    test: |
+      system bin/"uptop", "version"
+
 # Changelog generation must stay enabled: the --release-notes flag is consumed
 # by the changelog pipe, so disabling it silently drops the git-cliff notes
 # (empty release body on v0.1.0-rc.1). With --release-notes set, GoReleaser