diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d3fb7ba..0969f29 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,3 +28,11 @@ jobs:
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      # Render the cross-platform Homebrew formula from dist/checksums.txt and
+      # push it to the tap. Needs a PAT (default GITHUB_TOKEN can't push cross-repo).
+      - name: Publish Homebrew formula
+        run: ./scripts/update-formula.sh
+        env:
+          VERSION: ${{ github.ref_name }}
+          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3e2ff64..c057e26 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.11.0]
+
+### Added
+
+Adding support for Homebrew.
+
 ## [0.10.0]
 
 ### Fixed
diff --git a/README.md b/README.md
index 0c9beed..9f4346f 100644
--- a/README.md
+++ b/README.md
@@ -26,6 +26,14 @@ deno run index.ts                      # your app just sees normal env vars
 
 **1. Install**
 
+Homebrew, on macOS or Linux:
+
+```sh
+brew install vars-cli/tap/vars
+```
+
+Or grab a binary directly:
+
 ```sh
 # macOS (Apple Silicon)
 curl -L https://github.com/vars-cli/vars/releases/latest/download/vars_darwin_arm64.tar.gz | tar xz
diff --git a/justfile b/justfile
index a6b4bcf..aec3ec6 100644
--- a/justfile
+++ b/justfile
@@ -96,3 +96,8 @@ smoke: build
 [group('release')]
 release-dry:
     goreleaser release --snapshot --clean
+
+# Preview the Homebrew formula from a snapshot build (no push)
+[group('release')]
+formula-preview: release-dry
+    VERSION={{version}} ./scripts/update-formula.sh
diff --git a/scripts/update-formula.sh b/scripts/update-formula.sh
new file mode 100755
index 0000000..99abf03
--- /dev/null
+++ b/scripts/update-formula.sh
@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+# Render the cross-platform Homebrew formula and push it to the tap repo.
+#
+# A Homebrew *formula* (not a cask) is the only artifact that serves both macOS
+# and Linux, so we ship one. We render it ourselves rather than via GoReleaser's
+# `brews:` because that key is deprecated (removed in GoReleaser v2.16); a
+# hand-rendered formula depends only on the stable Homebrew DSL.
+#
+# Runs in CI right after `goreleaser release`, reading sha256s from the local
+# dist/checksums.txt (no release-asset round-trip, so no upload race).
+#
+# Env:
+#   VERSION             release tag, e.g. v0.9.0            (required)
+#   HOMEBREW_TAP_TOKEN  PAT with contents:write on the tap  (omit -> dry run:
+#                       prints the formula and exits without pushing)
+set -euo pipefail
+
+REPO="vars-cli/vars"
+TAP_REPO="vars-cli/homebrew-tap"
+FORMULA="vars"
+CHECKSUMS="dist/checksums.txt"
+
+: "${VERSION:?set VERSION to the release tag, e.g. v0.9.0}"
+version="${VERSION#v}" # formula version carries no leading "v"
+
+[[ -f "$CHECKSUMS" ]] || {
+    echo "ERROR: $CHECKSUMS not found — run 'goreleaser release' (or 'just release-dry') first" >&2
+    exit 1
+}
+
+# sha256 for an archive basename, by exact match in checksums.txt ("<sha>  <name>").
+sha_for() {
+    local name="$1" sha
+    sha=$(awk -v n="$name" '$2 == n {print $1}' "$CHECKSUMS")
+    [[ -n "$sha" ]] || {
+        echo "ERROR: $name not found in $CHECKSUMS" >&2
+        exit 1
+    }
+    printf '%s' "$sha"
+}
+
+base="https://github.com/${REPO}/releases/download/${VERSION}"
+darwin_arm="${FORMULA}_darwin_arm64.tar.gz"
+darwin_amd="${FORMULA}_darwin_amd64.tar.gz"
+linux_arm="${FORMULA}_linux_arm64.tar.gz"
+linux_amd="${FORMULA}_linux_amd64.tar.gz"
+
+# Resolve all shas up front, as plain assignments: a missing archive makes
+# sha_for exit non-zero, which aborts the script under `set -e`. Calling sha_for
+# inside the heredoc instead would only fail its own subshell, leaving an empty
+# sha256 in a formula we'd then push.
+sha_darwin_arm="$(sha_for "$darwin_arm")"
+sha_darwin_amd="$(sha_for "$darwin_amd")"
+sha_linux_arm="$(sha_for "$linux_arm")"
+sha_linux_amd="$(sha_for "$linux_amd")"
+
+formula=$(
+    cat <<EOF
+class Vars < Formula
+  desc "Encrypted store for your environment variables, unlocked by your SSH key"
+  homepage "https://github.com/${REPO}"
+  version "${version}"
+
+  on_macos do
+    on_arm do
+      url "${base}/${darwin_arm}"
+      sha256 "${sha_darwin_arm}"
+    end
+    on_intel do
+      url "${base}/${darwin_amd}"
+      sha256 "${sha_darwin_amd}"
+    end
+  end
+
+  on_linux do
+    on_arm do
+      url "${base}/${linux_arm}"
+      sha256 "${sha_linux_arm}"
+    end
+    on_intel do
+      url "${base}/${linux_amd}"
+      sha256 "${sha_linux_amd}"
+    end
+  end
+
+  def install
+    bin.install "vars"
+  end
+
+  test do
+    assert_match version.to_s, shell_output("#{bin}/vars --version")
+  end
+end
+EOF
+)
+
+if [[ -z "${HOMEBREW_TAP_TOKEN:-}" ]]; then
+    echo "# DRY RUN (HOMEBREW_TAP_TOKEN unset) — formula below, not pushed:" >&2
+    printf '%s\n' "$formula"
+    exit 0
+fi
+
+workdir=$(mktemp -d)
+trap 'rm -rf "$workdir"' EXIT
+git clone --depth 1 "https://x-access-token:${HOMEBREW_TAP_TOKEN}@github.com/${TAP_REPO}.git" "$workdir/tap"
+
+mkdir -p "$workdir/tap/Formula"
+printf '%s\n' "$formula" >"$workdir/tap/Formula/${FORMULA}.rb"
+
+git -C "$workdir/tap" config user.name "github-actions[bot]"
+git -C "$workdir/tap" config user.email "github-actions[bot]@users.noreply.github.com"
+git -C "$workdir/tap" add "Formula/${FORMULA}.rb"
+if git -C "$workdir/tap" diff --cached --quiet; then
+    echo "Formula already up to date for ${VERSION}; nothing to push."
+    exit 0
+fi
+git -C "$workdir/tap" commit -m "${FORMULA} ${version}"
+git -C "$workdir/tap" push
+echo "Pushed ${FORMULA} ${version} to ${TAP_REPO}"